by Kastro CVE-2026-4177
TODDR YAML::Syck — YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter
Description · from the CVE record
YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. The heap overflow occurs when class names exceed the initial 512-byte allocation. The base64 decoder could read past the buffer end on trailing newlines. strtok mutated n->type_id in place, corrupting shared node data. A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.
Affected
ProductAffectedFixed inSource
YAML::Syck≤ 1.36–CNA
Red Hat Enterprise Linux 7 Extended Lifecycle Supportsee advisory0:1.27-3.el7_9.1redhat-SADP
Red Hat Enterprise Linux 8see advisory0:1.30-6.el8_10redhat-SADP
Red Hat Enterprise Linux 6see advisory–redhat-SADP
Scores by source
CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
redhat-SADP (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial