CVE-2026-4177

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.

The heap overflow occurs when class names exceed the initial 512-byte allocation.

The base64 decoder could read past the buffer end on trailing newlines.

strtok mutated n->type_id in place, corrupting shared node data.

A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. The heap overflow occurs when class names exceed the initial 512-byte allocation. The base64 decoder could read past the buffer end on trailing newlines. strtok mutated n->type_id in place, corrupting shared node data. A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.

This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around.

Security Fix(es):

• perl-YAML-Syck: YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter (CVE-2026-4177)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. The heap overflow occurs when class names exceed the initial 512-byte allocation. The base64 decoder could read past the buffer end on trailing newlines. strtok mutated n->type_id in place, corrupting shared node data. A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.

This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around.

Security Fix(es):

• perl-YAML-Syck: YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter (CVE-2026-4177)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.

The heap overflow occurs when class names exceed the initial 512-byte allocation.

The base64 decoder could read past the buffer end on trailing newlines.

strtok mutated n->type_id in place, corrupting shared node data.

A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.

The heap overflow occurs when class names exceed the initial 512-byte allocation.

The base64 decoder could read past the buffer end on trailing newlines.

strtok mutated n->type_id in place, corrupting shared node data.

A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. (CVE-2026-4177)

These are all security issues fixed in the perl-YAML-Syck-1.440.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for perl-YAML-Syck fixes the following issues:

Changes in perl-YAML-Syck:

• updated to 1.450.0 (1.45) [Bug Fixes]

  • Fix: use syck_base64_free() to fix Windows "Free to wrong pool" crash in base64 encode/decode buffers; also plugs a memory leak (PR #189)
  • Fix: clear type tag on blessed scalar alias early-return so the stale tag no longer leaks onto the next emitted item (GH #193, PR #194)
  • Fix: negative float#base60 values produce wrong results; strip sign before accumulating and avoid negative zero for portable stringification (PR #191)
  • Fix: prevent memory leaks when Load/LoadJSON croak on parse errors (PR #192) [Maintenance]
  • Test: add coverage for SortKeys and JSON MaxDepth (PR #188)
  • Test: add error handling coverage for LoadFile/DumpFile (PR #190)
  • Update README

• updated to 1.440.0 (1.44) [Bug Fixes]

  • Fix: positive hex and octal values parsed as 0 with ImplicitTyping (PR #187)
  • Fix: resolve uintptr_t redefinition error on Win64 MinGW (PR #186) 1.43 Apr 01 2026 [Bug Fixes]
  • Fix: prevent resource leaks on croak/early-return paths in Dump (PR #161)
  • Fix: prevent output SV leaks on croak in Dump/DumpFile callers (PR #163)
  • Fix: Load() in list context returns empty list for empty/undef input; also applies to LoadBytes and LoadUTF8 (GH #164, PR #165)
  • Fix: DumpCode serializes prototype string instead of code body (PR #168)
  • Fix: memory leak in !perl/scalar Load — newRV_inc should be newRV_noinc (PR #170)
  • Fix: add pTHX_ to SAVEDESTRUCTOR_X callback for threaded Perl (GH #175, PR #176)
  • Fix: add TODO guard for eval_pv leak on Perl < 5.14 (GH #179, PR #180)
  • Fix: negative hex and octal values parsed as 0 with ImplicitTyping (PR #183)
  • Fix: negative int#base60 values produce unsigned wraparound (PR #185) [Improvements]
  • Modernize META_MERGE for CPANTS compliance (PR #162)
  • Fix hash table size handling and remove compile warnings in syck_st (PR #174) [Maintenance]
  • Restore TODO guard for Dump code leak test on Perl < 5.26 (PR #167)
  • Resolve 2010 TODO in perl_json_postprocess with test coverage (PR #166)
  • CI: upgrade actions to resolve Node.js 20 deprecation warnings (PR #177) 1.42 Mar 27 2026 [Bug Fixes]
  • Fix: replace strtok() with strpbrk() and fix sign-compare warnings in perl_syck.h (PR #145)
  • Fix: terminate plain scalars at document boundaries --- and ... (PR #150)
  • Fix: skip %TAG and %YAML directives in document header (PR #151)
  • Fix: plug SV leak when eval_pv croaks on bad perl/code blocks (PR #153)
  • Fix: allow non-specific tag '!' before block scalars (GH #27, PR #102)
  • Fix: remove spurious %type <nodeId> for indent_open in gram.y (GH #157, PR #158)
  • Fix: use modern bison %define api.prefix directive (GH #159, PR #160) [Improvements]
  • Implement YAML merge key (<<) support (PR #149) [Maintenance]
  • Remove dead Perl 5.6/5.8 version guards from test files (PR #146)
  • Add YAML 1.0 spec compliance audit and coverage tests (PR #148)
  • Add comprehensive round-trip tests for YAML 1.0 spec features (PR #152)
  • Remove unneeded TODO in t/json-basic.t (PR #154)
  • Add regex Dump/Load/round-trip tests to perl tag scheme (PR #155)
  • Do not require a .y file to build YAML::Syck; add brew support for bison
  • Don't ship docs/ directory in tarball 1.41 Mar 22 2026 [Bug Fixes]
  • Fix float parsing on -Dusequadmath perls: use Perl's Atof() instead of strtod() so that floats like -3.14 are not corrupted by double-precision rounding artifacts (GH #140, PR #141) 1.39 Mar 21 2026 [Bug Fixes]
  • Fix t/yaml-implicit-typing.t failure with -Duselongdouble perls (GH #138, PR #139) 1.38 Mar 20 2026 [Bug Fixes]
  • Fix: escape solidus (/) as / in JSON::Syck::Dump…