CVE-2026-13713

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.

In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.

Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.

This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around.

Security Fix(es):

• YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document (CVE-2026-13713)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.

This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around.

Security Fix(es):

• YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document (CVE-2026-13713)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.

In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.

Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.

In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.

Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len

These are all security issues fixed in the perl-YAML-Syck-1.470.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for perl-YAML-Syck fixes the following issues:

Changes in perl-YAML-Syck:

• updated to 1.470.0 (1.47) [Security]

  • Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags (reported by Paul Johnson via CPANSec, PR #213):
    • CVE-2026-57075 (CWE-125): out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input bsc#1271632
    • CVE-2026-57076 (CWE-416): use-after-free of an anchor key string shared between the node and the anchors table bsc#1271633
    • CVE-2026-57077 (CWE-125): one-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683) bsc#1271634
    • CVE-2026-13713 (CWE-416/CWE-415): use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input bsc#1271631
  • Harden syck_base64dec() to bounds-check each read so it cannot run past a non-NUL-terminated input buffer (defense-in-depth for callers passing raw buffers; PR #213) [Bug Fixes]
  • Fix: enforce $MaxDepth on Load to prevent C-stack exhaustion from deeply nested YAML/JSON input; YAML::Syck and JSON::Syck Load now default to 512, matching Dump (PR #204)
  • Fix: emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values in Dump so they roundtrip with ImplicitTyping instead of reloading as plain strings (PR #201) [Maintenance]
  • CI: add an AddressSanitizer job that builds the XS with -fsanitize=address and runs the suite plus the CVE trigger inputs to catch libsyck memory-safety defects; de-pin the libasan version so it tracks the runner's GCC (PR #213)

• updated to 1.460.0 (1.46) [Bug Fixes]

  • Fix: preserve string nature of numeric-looking values in Dump; pure strings (POK only, no IOK/NOK) are now quoted to maintain roundtrip fidelity (GH #199, PR #200)
  • Fix: accept trailing commas in flow sequences and mappings ([a, b,] and {a: 1,}), valid per YAML 1.0/1.1/1.2 spec (GH #195, PR #196)

  [Maintenance]

  • CI: upgrade install-with-cpm to v2 for compatibility with Perl versions prior to 5.24 in perldocker containers (GH #197, PR #198)
  • Clean up MANIFEST.SKIP: add #!include_default, remove redundant entries, exclude .claude/ from distribution

This update for perl-YAML-Syck fixes the following issues:

Changes in perl-YAML-Syck:

• updated to 1.470.0 (1.47) [Security]

  • Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags (reported by Paul Johnson via CPANSec, PR #213):
    • CVE-2026-57075 (CWE-125): out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input bsc#1271632
    • CVE-2026-57076 (CWE-416): use-after-free of an anchor key string shared between the node and the anchors table bsc#1271633
    • CVE-2026-57077 (CWE-125): one-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683) bsc#1271634
    • CVE-2026-13713 (CWE-416/CWE-415): use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input bsc#1271631
  • Harden syck_base64dec() to bounds-check each read so it cannot run past a non-NUL-terminated input buffer (defense-in-depth for callers passing raw buffers; PR #213) [Bug Fixes]
  • Fix: enforce $MaxDepth on Load to prevent C-stack exhaustion from deeply nested YAML/JSON input; YAML::Syck and JSON::Syck Load now default to 512, matching Dump (PR #204)
  • Fix: emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values in Dump so they roundtrip with ImplicitTyping instead of reloading as plain strings (PR #201) [Maintenance]
  • CI: add an AddressSanitizer job that builds the XS with -fsanitize=address and runs the suite plus the CVE trigger inputs to catch libsyck memory-safety defects; de-pin the libasan version so it tracks the runner's GCC (PR #213)

• updated to 1.460.0 (1.46) [Bug Fixes]

  • Fix: preserve string nature of numeric-looking values in Dump; pure strings (POK only, no IOK/NOK) are now quoted to maintain roundtrip fidelity (GH #199, PR #200)
  • Fix: accept trailing commas in flow sequences and mappings ([a, b,] and {a: 1,}), valid per YAML 1.0/1.1/1.2 spec (GH #195, PR #196)

  [Maintenance]

  • CI: upgrade install-with-cpm to v2 for compatibility with Perl versions prior to 5.24 in perldocker containers (GH #197, PR #198)
  • Clean up MANIFEST.SKIP: add #!include_default, remove redundant entries, exclude .claude/ from distribution