Every CVE Search/ Get API key

CVE-2026-63676

Updated perl-YAML packages fix a security vulnerability

5.4 MediumFix available

Updated packages fixes CVE-2026-63676

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

What each source reports

OSV Score usedOESA-2026-3237 5.4

perl-YAML security update

The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.

Security Fix(es):

The MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)

Record
OESA-2026-3237
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSV Score usedOESA-2026-3238 5.4

perl-YAML security update

The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.

Security Fix(es):

The MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)

Record
OESA-2026-3238
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSV Score usedOESA-2026-3239 5.4

perl-YAML security update

The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.

Security Fix(es):

The MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)

Record
OESA-2026-3239
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSV Score usedOESA-2026-3240 5.4

perl-YAML security update

The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.

Security Fix(es):

The MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)

Record
OESA-2026-3240
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSV Score usedOESA-2026-3406 5.4

perl-YAML security update

The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.

Security Fix(es):

The MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)

Record
OESA-2026-3406
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVMGASA-2026-0426 No score

Updated perl-YAML packages fix a security vulnerability

Updated packages fixes CVE-2026-63676

Record
MGASA-2026-0426
Updated
2026-11-02
OSVopenSUSE-SU-2026:11321-1 No score

perl-YAML-1.320.0-1.1 on GA media

These are all security issues fixed in the perl-YAML-1.320.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11321-1
Updated
2026-11-02
OSVUBUNTU-CVE-2026-63676 No score

backtracking leading to exponential load time

Record
UBUNTU-CVE-2026-63676
Updated
2026-11-02
OSVUSN-8925-1 No score

libyaml-perl vulnerabilities

Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection operations. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-20285)

It was discovered that YAML-LibYAML did not correctly handle parsing certain documents. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-25777)

It was discovered that YAML-LibYAML contained a regular expression susceptible to catastrophic backtracking. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. (CVE-2026-63676)

Record
USN-8925-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
libyaml-perl
Debian:12
 All versions, plus listed versions
1.30-21.31-11.321-1
 None known
libyaml-perl
Debian:13
 All versions, plus listed versions
1.31-11.321-1
 None known
libyaml-perl
Debian:14
 before 1.321-1, plus listed versions
1.31-1
1.321-1
perl-YAML
Mageia:10
 before 1.310.0-2.1.mga10
1.310.0-2.1.mga10
perl-YAML
Mageia:9
 before 1.300.0-3.1.mga9
1.300.0-3.1.mga9
perl-YAML
openEuler:20.03-LTS-SP4
 before 1.26-7.oe2003sp4
1.26-7.oe2003sp4
perl-YAML
openEuler:24.03-LTS-SP1
 before 1.321-1.oe2403sp1
1.321-1.oe2403sp1
perl-YAML
openEuler:24.03-LTS-SP3
 before 1.321-1.oe2403sp3
1.321-1.oe2403sp3
perl-YAML
openEuler:24.03-LTS-SP4
 before 1.321-1.oe2403sp4
1.321-1.oe2403sp4
perl-YAML
openEuler:22.03-LTS-SP4
 before 1.321-1.oe2203sp4
1.321-1.oe2203sp4
Show 14 moreShow less
Affected packages
PackageAffectedFixed
libyaml-perl
Ubuntu:Pro:16.04:LTS
 before 1.15-1ubuntu0.1~esm1, plus listed versions
1.13-11.15-1
1.15-1ubuntu0.1~esm1
libyaml-perl
Ubuntu:Pro:18.04:LTS
 before 1.24-1ubuntu0.1~esm1, plus listed versions
1.21-11.24-1
1.24-1ubuntu0.1~esm1
libyaml-perl
Ubuntu:Pro:20.04:LTS
 before 1.30-1ubuntu0.20.04.1~esm1, plus listed versions
1.29-11.30-1
1.30-1ubuntu0.20.04.1~esm1
libyaml-perl
Ubuntu:22.04:LTS
 before 1.30-1ubuntu0.22.04.1, plus listed versions
1.30-1
1.30-1ubuntu0.22.04.1
libyaml-perl
Ubuntu:24.04:LTS
 before 1.31-1ubuntu0.24.04.1, plus listed versions
1.30-21.31-1
1.31-1ubuntu0.24.04.1
libyaml-perl
Ubuntu:26.10
 All versions, plus listed versions
1.31-1
 None known
libyaml-perl
Ubuntu:Pro:26.04:LTS
 before 1.31-1ubuntu0.26.04.1~esm1, plus listed versions
1.31-1
1.31-1ubuntu0.26.04.1~esm1
libyaml-perl
Ubuntu:Pro:16.04:LTS
From an advisory covering 3 CVEs
 before 1.15-1ubuntu0.1~esm1, plus listed versions
1.13-11.15-1
1.15-1ubuntu0.1~esm1
libyaml-perl
Ubuntu:Pro:18.04:LTS
From an advisory covering 3 CVEs
 before 1.24-1ubuntu0.1~esm1, plus listed versions
1.21-11.24-1
1.24-1ubuntu0.1~esm1
libyaml-perl
Ubuntu:Pro:20.04:LTS
From an advisory covering 3 CVEs
 before 1.30-1ubuntu0.20.04.1~esm1, plus listed versions
1.29-11.30-1
1.30-1ubuntu0.20.04.1~esm1
libyaml-perl
Ubuntu:22.04:LTS
From an advisory covering 3 CVEs
 before 1.30-1ubuntu0.22.04.1, plus listed versions
1.30-1
1.30-1ubuntu0.22.04.1
libyaml-perl
Ubuntu:24.04:LTS
From an advisory covering 3 CVEs
 before 1.31-1ubuntu0.24.04.1, plus listed versions
1.30-21.31-1
1.31-1ubuntu0.24.04.1
libyaml-perl
Ubuntu:Pro:26.04:LTS
From an advisory covering 3 CVEs
 before 1.31-1ubuntu0.26.04.1~esm1, plus listed versions
1.31-1
1.31-1ubuntu0.26.04.1~esm1
perl-YAML
openSUSE:Tumbleweed
 before 1.320.0-1.1
1.320.0-1.1

History

History
RecordedChangedSources
affected, facts
first indexedOSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-63676 is a medium vulnerability (CVSS 5.4) in perl-YAML, published July 21, 2026. No source lists public exploit code. Fixed in libyaml-perl 1.321-1.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open