CVE-2025-11683
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
YAML::Syck for Perl before version 1.36 has missing null terminators, causing out-of-bounds read and potential information disclosure. The issue is in token.c and occurs with complex YAML files containing a hash of all keys and empty values.
Risk Assessment
Out-of-bounds read may expose adjacent memory data, potentially leading to disclosure of sensitive information.
Recommendation
Update YAML::Syck to version 1.36 or later to fix the missing null terminators.
Other vulnerabilities in YAML::Syck
See all- CVE-2026-57075Critical
In YAML::Syck for Perl before version 1.47, an out-of-bounds read vulnerability exists in the syck_base64dec function. It uses a signed char index to access the b64_xtable array, causing reads before the table when bytes >= 0x80 are encountered. The vulnerability is triggered by default Load or LoadFile calls on untrusted YAML documents containing a !!binary scalar with a high-bit byte.
- CVE-2026-4177Critical
The YAML::Syck library versions up to 1.36 for Perl contains several potential security vulnerabilities, including a high-severity heap buffer overflow in the YAML emitter. The overflow occurs when class names exceed the initial 512-byte allocation.
- CVE-2026-57077High
A vulnerability in YAML::Syck for Perl before version 1.47 allows an out-of-bounds read via an unbounded newline scan in the newline_len function. The issue occurs during block-scalar lexing at a document boundary, where the scan runs one byte past the heap lexer buffer.
- CVE-2026-57076High
A heap use-after-free vulnerability exists in YAML::Syck for Perl before version 1.47. The issue occurs when an anchor name is reused as a key in the anchors table in syck_hdlr_add_anchor, leading to reading freed heap memory.
- CVE-2026-13713Medium
In YAML::Syck for Perl before version 1.47, a use-after-free and double-free vulnerability exists when an anchor node is freed while still on the parser value stack. This causes a second free and interpreter crash.
Original NVD description (English source)
YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read The issue is seen with complex YAML files with a hash of all keys and empty values. There is no indication that the issue leads to accessing memory outside that allocated to the module.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS