CVE-2026-4177
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
The YAML::Syck library versions up to 1.36 for Perl contains several potential security vulnerabilities, including a high-severity heap buffer overflow in the YAML emitter. The overflow occurs when class names exceed the initial 512-byte allocation.
Risk Assessment
The risk includes potential remote code execution or application crashes due to heap buffer overflow, as well as memory leaks and corruption of shared node data, which may lead to unpredictable system behavior.
Recommendation
It is recommended to immediately update the YAML::Syck library to the latest available version or migrate to an alternative YAML library such as YAML::XS, which is actively maintained.
Other vulnerabilities in YAML::Syck
See all- CVE-2026-57075Critical
In YAML::Syck for Perl before version 1.47, an out-of-bounds read vulnerability exists in the syck_base64dec function. It uses a signed char index to access the b64_xtable array, causing reads before the table when bytes >= 0x80 are encountered. The vulnerability is triggered by default Load or LoadFile calls on untrusted YAML documents containing a !!binary scalar with a high-bit byte.
- CVE-2026-57077High
A vulnerability in YAML::Syck for Perl before version 1.47 allows an out-of-bounds read via an unbounded newline scan in the newline_len function. The issue occurs during block-scalar lexing at a document boundary, where the scan runs one byte past the heap lexer buffer.
- CVE-2026-57076High
A heap use-after-free vulnerability exists in YAML::Syck for Perl before version 1.47. The issue occurs when an anchor name is reused as a key in the anchors table in syck_hdlr_add_anchor, leading to reading freed heap memory.
- CVE-2026-13713Medium
In YAML::Syck for Perl before version 1.47, a use-after-free and double-free vulnerability exists when an anchor node is freed while still on the parser value stack. This causes a second free and interpreter crash.
- CVE-2025-11683Medium
YAML::Syck for Perl before version 1.36 has missing null terminators, causing out-of-bounds read and potential information disclosure. The issue is in token.c and occurs with complex YAML files containing a hash of all keys and empty values.
Original NVD description (English source)
YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. The heap overflow occurs when class names exceed the initial 512-byte allocation. The base64 decoder could read past the buffer end on trailing newlines. strtok mutated n->type_id in place, corrupting shared node data. A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS