CVE-2025-11683

YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read The issue is seen with complex YAML files with a hash of all keys and empty values.  There is no indication that the issue leads to accessing memory outside that allocated to the module.

YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read The issue is seen with complex YAML files with a hash of all keys and empty values.  There is no indication that the issue leads to accessing memory outside that allocated to the module.

YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure

Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read

The issue is seen with complex YAML files with a hash of all keys and empty values.  There is no indication that the issue leads to accessing memory outside that allocated to the module.

YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure

Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read

The issue is seen with complex YAML files with a hash of all keys and empty values.  There is no indication that the issue leads to accessing memory outside that allocated to the module.

These are all security issues fixed in the perl-YAML-Syck-1.450.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for perl-YAML-Syck fixes the following issues:

Changes in perl-YAML-Syck:

• updated to 1.450.0 (1.45) [Bug Fixes]

  • Fix: use syck_base64_free() to fix Windows "Free to wrong pool" crash in base64 encode/decode buffers; also plugs a memory leak (PR #189)
  • Fix: clear type tag on blessed scalar alias early-return so the stale tag no longer leaks onto the next emitted item (GH #193, PR #194)
  • Fix: negative float#base60 values produce wrong results; strip sign before accumulating and avoid negative zero for portable stringification (PR #191)
  • Fix: prevent memory leaks when Load/LoadJSON croak on parse errors (PR #192) [Maintenance]
  • Test: add coverage for SortKeys and JSON MaxDepth (PR #188)
  • Test: add error handling coverage for LoadFile/DumpFile (PR #190)
  • Update README

• updated to 1.440.0 (1.44) [Bug Fixes]

  • Fix: positive hex and octal values parsed as 0 with ImplicitTyping (PR #187)
  • Fix: resolve uintptr_t redefinition error on Win64 MinGW (PR #186) 1.43 Apr 01 2026 [Bug Fixes]
  • Fix: prevent resource leaks on croak/early-return paths in Dump (PR #161)
  • Fix: prevent output SV leaks on croak in Dump/DumpFile callers (PR #163)
  • Fix: Load() in list context returns empty list for empty/undef input; also applies to LoadBytes and LoadUTF8 (GH #164, PR #165)
  • Fix: DumpCode serializes prototype string instead of code body (PR #168)
  • Fix: memory leak in !perl/scalar Load — newRV_inc should be newRV_noinc (PR #170)
  • Fix: add pTHX_ to SAVEDESTRUCTOR_X callback for threaded Perl (GH #175, PR #176)
  • Fix: add TODO guard for eval_pv leak on Perl < 5.14 (GH #179, PR #180)
  • Fix: negative hex and octal values parsed as 0 with ImplicitTyping (PR #183)
  • Fix: negative int#base60 values produce unsigned wraparound (PR #185) [Improvements]
  • Modernize META_MERGE for CPANTS compliance (PR #162)
  • Fix hash table size handling and remove compile warnings in syck_st (PR #174) [Maintenance]
  • Restore TODO guard for Dump code leak test on Perl < 5.26 (PR #167)
  • Resolve 2010 TODO in perl_json_postprocess with test coverage (PR #166)
  • CI: upgrade actions to resolve Node.js 20 deprecation warnings (PR #177) 1.42 Mar 27 2026 [Bug Fixes]
  • Fix: replace strtok() with strpbrk() and fix sign-compare warnings in perl_syck.h (PR #145)
  • Fix: terminate plain scalars at document boundaries --- and ... (PR #150)
  • Fix: skip %TAG and %YAML directives in document header (PR #151)
  • Fix: plug SV leak when eval_pv croaks on bad perl/code blocks (PR #153)
  • Fix: allow non-specific tag '!' before block scalars (GH #27, PR #102)
  • Fix: remove spurious %type <nodeId> for indent_open in gram.y (GH #157, PR #158)
  • Fix: use modern bison %define api.prefix directive (GH #159, PR #160) [Improvements]
  • Implement YAML merge key (<<) support (PR #149) [Maintenance]
  • Remove dead Perl 5.6/5.8 version guards from test files (PR #146)
  • Add YAML 1.0 spec compliance audit and coverage tests (PR #148)
  • Add comprehensive round-trip tests for YAML 1.0 spec features (PR #152)
  • Remove unneeded TODO in t/json-basic.t (PR #154)
  • Add regex Dump/Load/round-trip tests to perl tag scheme (PR #155)
  • Do not require a .y file to build YAML::Syck; add brew support for bison
  • Don't ship docs/ directory in tarball 1.41 Mar 22 2026 [Bug Fixes]
  • Fix float parsing on -Dusequadmath perls: use Perl's Atof() instead of strtod() so that floats like -3.14 are not corrupted by double-precision rounding artifacts (GH #140, PR #141) 1.39 Mar 21 2026 [Bug Fixes]
  • Fix t/yaml-implicit-typing.t failure with -Duselongdouble perls (GH #138, PR #139) 1.38 Mar 20 2026 [Bug Fixes]
  • Fix: escape solidus (/) as / in JSON::Syck::Dump…

This update for perl-YAML-Syck fixes the following issues:

Changes in perl-YAML-Syck:

• updated to 1.470.0 (1.47) [Security]

  • Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags (reported by Paul Johnson via CPANSec, PR #213):
    • CVE-2026-57075 (CWE-125): out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input bsc#1271632
    • CVE-2026-57076 (CWE-416): use-after-free of an anchor key string shared between the node and the anchors table bsc#1271633
    • CVE-2026-57077 (CWE-125): one-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683) bsc#1271634
    • CVE-2026-13713 (CWE-416/CWE-415): use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input bsc#1271631
  • Harden syck_base64dec() to bounds-check each read so it cannot run past a non-NUL-terminated input buffer (defense-in-depth for callers passing raw buffers; PR #213) [Bug Fixes]
  • Fix: enforce $MaxDepth on Load to prevent C-stack exhaustion from deeply nested YAML/JSON input; YAML::Syck and JSON::Syck Load now default to 512, matching Dump (PR #204)
  • Fix: emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values in Dump so they roundtrip with ImplicitTyping instead of reloading as plain strings (PR #201) [Maintenance]
  • CI: add an AddressSanitizer job that builds the XS with -fsanitize=address and runs the suite plus the CVE trigger inputs to catch libsyck memory-safety defects; de-pin the libasan version so it tracks the runner's GCC (PR #213)

• updated to 1.460.0 (1.46) [Bug Fixes]

  • Fix: preserve string nature of numeric-looking values in Dump; pure strings (POK only, no IOK/NOK) are now quoted to maintain roundtrip fidelity (GH #199, PR #200)
  • Fix: accept trailing commas in flow sequences and mappings ([a, b,] and {a: 1,}), valid per YAML 1.0/1.1/1.2 spec (GH #195, PR #196)

  [Maintenance]

  • CI: upgrade install-with-cpm to v2 for compatibility with Perl versions prior to 5.24 in perldocker containers (GH #197, PR #198)
  • Clean up MANIFEST.SKIP: add #!include_default, remove redundant entries, exclude .claude/ from distribution

This update for perl-YAML-Syck fixes the following issues:

Changes in perl-YAML-Syck:

• updated to 1.470.0 (1.47) [Security]

  • Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags (reported by Paul Johnson via CPANSec, PR #213):
    • CVE-2026-57075 (CWE-125): out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input bsc#1271632
    • CVE-2026-57076 (CWE-416): use-after-free of an anchor key string shared between the node and the anchors table bsc#1271633
    • CVE-2026-57077 (CWE-125): one-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683) bsc#1271634
    • CVE-2026-13713 (CWE-416/CWE-415): use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input bsc#1271631
  • Harden syck_base64dec() to bounds-check each read so it cannot run past a non-NUL-terminated input buffer (defense-in-depth for callers passing raw buffers; PR #213) [Bug Fixes]
  • Fix: enforce $MaxDepth on Load to prevent C-stack exhaustion from deeply nested YAML/JSON input; YAML::Syck and JSON::Syck Load now default to 512, matching Dump (PR #204)
  • Fix: emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values in Dump so they roundtrip with ImplicitTyping instead of reloading as plain strings (PR #201) [Maintenance]
  • CI: add an AddressSanitizer job that builds the XS with -fsanitize=address and runs the suite plus the CVE trigger inputs to catch libsyck memory-safety defects; de-pin the libasan version so it tracks the runner's GCC (PR #213)

• updated to 1.460.0 (1.46) [Bug Fixes]

  • Fix: preserve string nature of numeric-looking values in Dump; pure strings (POK only, no IOK/NOK) are now quoted to maintain roundtrip fidelity (GH #199, PR #200)
  • Fix: accept trailing commas in flow sequences and mappings ([a, b,] and {a: 1,}), valid per YAML 1.0/1.1/1.2 spec (GH #195, PR #196)

  [Maintenance]

  • CI: upgrade install-with-cpm to v2 for compatibility with Perl versions prior to 5.24 in perldocker containers (GH #197, PR #198)
  • Clean up MANIFEST.SKIP: add #!include_default, remove redundant entries, exclude .claude/ from distribution

It was discovered that YAML::Syck did not properly handle parsing YAML files. An attacker could possibly use this issue to expose sensitive information.