CVE-2026-57077
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A vulnerability in YAML::Syck for Perl before version 1.47 allows an out-of-bounds read via an unbounded newline scan in the newline_len function. The issue occurs during block-scalar lexing at a document boundary, where the scan runs one byte past the heap lexer buffer.
Risk Assessment
An attacker can exploit this vulnerability to read data beyond the allocated buffer, potentially leading to disclosure of sensitive information or destabilization of applications processing untrusted YAML documents.
Recommendation
Immediately update YAML::Syck to version 1.47 or later. If an update is not possible, avoid processing untrusted YAML documents containing block scalars at document boundaries.
Other vulnerabilities in YAML::Syck
See all- CVE-2026-57075Critical
In YAML::Syck for Perl before version 1.47, an out-of-bounds read vulnerability exists in the syck_base64dec function. It uses a signed char index to access the b64_xtable array, causing reads before the table when bytes >= 0x80 are encountered. The vulnerability is triggered by default Load or LoadFile calls on untrusted YAML documents containing a !!binary scalar with a high-bit byte.
- CVE-2026-4177Critical
The YAML::Syck library versions up to 1.36 for Perl contains several potential security vulnerabilities, including a high-severity heap buffer overflow in the YAML emitter. The overflow occurs when class names exceed the initial 512-byte allocation.
- CVE-2026-57076High
A heap use-after-free vulnerability exists in YAML::Syck for Perl before version 1.47. The issue occurs when an anchor name is reused as a key in the anchors table in syck_hdlr_add_anchor, leading to reading freed heap memory.
- CVE-2026-13713Medium
In YAML::Syck for Perl before version 1.47, a use-after-free and double-free vulnerability exists when an anchor node is freed while still on the parser value stack. This causes a second free and interpreter crash.
Original NVD description (English source)
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover. Any caller that runs Load or LoadFile on an untrusted document with a block scalar at a document boundary reaches the over-read.