YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.
The heap overflow occurs when class names exceed the initial 512-byte allocation.
The base64 decoder could read past the buffer end on trailing newlines.
strtok mutated n->type_id in place, corrupting shared node data.
A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade perl-YAML-Syck | Apr 6, 2026 | Apr 2, 2026 |
| Alpine Linux | — | Upgrade perl-yaml-syck | Jun 18, 2026 | Mar 16, 2026 |
| Amazon Linux Ami 2 | — | Upgrade perl-YAML-Syck-debuginfoUpgrade perl-YAML-Syck | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade perl-YAML-Syck-testsUpgrade perl-YAML-Syck-debuginfoUpgrade perl-YAML-Syck-debugsourceUpgrade perl-YAML-Syck | Apr 7, 2026 | Mar 16, 2026 |
| Debian | — | Upgrade libyaml-syck-perl | Mar 24, 2026 | Mar 24, 2026 |
| Oracle_linux | — | Upgrade perl-YAML-Syck | Apr 22, 2026 | Mar 16, 2026 |
| Redhat_linux | — | Upgrade perl-YAML-Syck-debuginfoUpgrade perl-YAML-Syck-debugsourceNo solution existsUpgrade perl-YAML-Syck | Apr 3, 2026 | Mar 16, 2026 |
| Rocky_linux | — | Upgrade perl-YAML-SyckUpgrade perl-YAML-Syck-debugsourceUpgrade perl-YAML-Syck-debuginfo | Apr 10, 2026 | Apr 9, 2026 |
| Suse | — | Upgrade perl-YAML-Syck | May 25, 2026 | Apr 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub