{"id":"CVE-2025-40908","aliases":["ALSA-2025:9329","ALSA-2025:9330","AZL-62242","AZL-62279","DEBIAN-CVE-2025-40908","EUVD-2025-16577","GHSA-jh9m-3m95-c6hp","MGASA-2025-0275","OESA-2025-1591","RHSA-2025:9329","RHSA-2025:9330","RHSA-2025:9338","RLSA-2025:9329","RLSA-2025:9330","ROOT-OS-DEBIAN-11-CVE-2025-40908","SUSE-RU-2025:03081-1","SUSE-SU-2025:01885-1","SUSE-SU-2025:01885-2","SUSE-SU-2025:01886-1","UBUNTU-CVE-2025-40908","USN-7632-1","openSUSE-SU-2025:15261-1"],"status":"published","title":"YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified","description":"YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00472,"percentile":0.41068,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-552"],"published":"2025-06-01T13:41:48Z","modified":"2026-10-29T11:32:30Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"perl-YAML-LibYAML","fixed_in":["1:0.70-2.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"perl-YAML-LibYAML","fixed_in":["1:0.82-6.1.el9_6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"perl-YAML-LibYAML","fixed_in":["0.902.0-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libyaml-libyaml-perl","fixed_in":["0.86+ds-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libyaml-libyaml-perl","fixed_in":["0.903.0+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libyaml-libyaml-perl","fixed_in":["0.903.0+ds-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-YAML-LibYAML","fixed_in":["0.860.0-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-YAML-LibYAML","fixed_in":["0.83-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"perl-YAML-LibYAML","fixed_in":["0.88-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-YAML-LibYAML","fixed_in":["0.88-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-YAML-LibYAML","fixed_in":["0.74-3.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"perl-YAML-LibYAML","fixed_in":["0.83-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-YAML-LibYAML","fixed_in":["1:0.70-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-YAML-LibYAML-debuginfo","fixed_in":["1:0.70-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-YAML-LibYAML-debugsource","fixed_in":["1:0.70-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-YAML-LibYAML","fixed_in":["1:0.82-6.1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-YAML-LibYAML-debuginfo","fixed_in":["1:0.82-6.1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-YAML-LibYAML-debugsource","fixed_in":["1:0.82-6.1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"perl-YAML-LibYAML","fixed_in":["1:0.82-6.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"perl-YAML-LibYAML-debuginfo","fixed_in":["1:0.82-6.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"perl-YAML-LibYAML-debugsource","fixed_in":["1:0.82-6.el9_4.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"perl-YAML-LibYAML","fixed_in":["1:0.70-2.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"perl-YAML-LibYAML","fixed_in":["1:0.82-6.1.el9_6"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"libyaml-libyaml-perl","fixed_in":["0.82+repack-1.root.io.1","0.82+repack-1.root.io.2","0.82+repack-1.root.io.3","0.82+repack-1.root.io.5","0.82+repack-1.root.io.4","0.82+repack-1.aikido.6","0.82+repack-1.aikido.7","0.82+repack-1.aikido.8"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-libyaml-libyaml-perl","fixed_in":["0.82+repack-1.root.io.1","0.82+repack-1.root.io.2","0.82+repack-1.root.io.3","0.82+repack-1.root.io.5","0.82+repack-1.root.io.4","0.82+repack-1.aikido.6","0.82+repack-1.aikido.7","0.82+repack-1.aikido.8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"perl-YAML-LibYAML","fixed_in":["0.904.0-150000.3.16.1","0.890.0-150000.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"perl-YAML-LibYAML","fixed_in":["0.904.0-150000.3.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"perl-YAML-LibYAML","fixed_in":["0.904.0-150000.3.16.1","0.890.0-150000.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-YAML-LibYAML","fixed_in":["0.38-11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"perl-YAML-LibYAML","fixed_in":["0.38-11.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libyaml-libyaml-perl","fixed_in":["0.83+ds-1ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libyaml-libyaml-perl","fixed_in":["0.89+ds-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-YAML-LibYAML","fixed_in":["0.904.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.70-2.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.82-6.1.el9_6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.902.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.81-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libyaml-libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.86+ds-1+deb12u1"}]}],"versions":["0.86+ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libyaml-libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.903.0+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libyaml-libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.903.0+ds-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.860.0-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.83-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.88-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.88-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-3.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.83-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.70-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-YAML-LibYAML-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.70-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-YAML-LibYAML-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.70-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.82-6.1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-YAML-LibYAML-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.82-6.1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-YAML-LibYAML-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.82-6.1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.82-6.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"perl-YAML-LibYAML-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.82-6.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"perl-YAML-LibYAML-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.82-6.el9_4.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.70-2.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.82-6.1.el9_6"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"libyaml-libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.82+repack-1.root.io.1"},{"fixed":"0.82+repack-1.root.io.2"},{"fixed":"0.82+repack-1.root.io.3"},{"fixed":"0.82+repack-1.root.io.5"},{"fixed":"0.82+repack-1.root.io.4"},{"fixed":"0.82+repack-1.aikido.6"},{"fixed":"0.82+repack-1.aikido.7"},{"fixed":"0.82+repack-1.aikido.8"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-libyaml-libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.82+repack-1.root.io.1"},{"fixed":"0.82+repack-1.root.io.2"},{"fixed":"0.82+repack-1.root.io.3"},{"fixed":"0.82+repack-1.root.io.5"},{"fixed":"0.82+repack-1.root.io.4"},{"fixed":"0.82+repack-1.aikido.6"},{"fixed":"0.82+repack-1.aikido.7"},{"fixed":"0.82+repack-1.aikido.8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.904.0-150000.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.904.0-150000.3.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.904.0-150000.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38-11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.890.0-150000.3.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.890.0-150000.3.11.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libyaml-libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.41-6","0.41-6build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libyaml-libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.63-2build1","0.69+repack-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libyaml-libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.80+repack-1","0.80+repack-1build1","0.80+repack-2","0.81+repack-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libyaml-libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.83+ds-1ubuntu0.22.04.1"}]}],"versions":["0.82+repack-1build1","0.82+repack-1build2","0.83+ds-1","0.83+ds-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libyaml-libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.89+ds-1ubuntu0.24.04.1"}]}],"versions":["0.86+ds-1","0.89+ds-1","0.89+ds-1build1","0.89+ds-1build2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libyaml-libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.83+ds-1ubuntu0.22.04.1"}]}],"versions":["0.82+repack-1build1","0.82+repack-1build2","0.83+ds-1","0.83+ds-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libyaml-libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.89+ds-1ubuntu0.24.04.1"}]}],"versions":["0.86+ds-1","0.89+ds-1","0.89+ds-1build1","0.89+ds-1build2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-YAML-LibYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.904.0-2.1"}]}]}],"products":[{"vendor":"ingydotnet","product":"yaml-libyaml"},{"vendor":"tinita","product":"yaml::libyaml"}],"references":[{"url":"https://github.com/ingydotnet/yaml-libyaml-pm/issues/120","tags":["issue-tracking","Exploit","Issue Tracking","report","article"]},{"url":"https://github.com/ingydotnet/yaml-libyaml-pm/pull/121","tags":["patch","Issue Tracking","Patch","fix","article"]},{"url":"https://github.com/ingydotnet/yaml-libyaml-pm/pull/122","tags":["patch","Issue Tracking","Patch","fix","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40908","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jh9m-3m95-c6hp"},{"url":"https://access.redhat.com/errata/RHSA-2025:9329","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-40908","tags":["report"]},{"url":"https://bugzilla.redhat.com/2369630","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-9329.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9330","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-9330.html","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40908.json","tags":["advisory"]},{"url":"https://github.com/ingydotnet/yaml-libyaml-pm","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-40908","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0275.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34448","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/HKC72252CNE2PZENAI7UN24YB5X2Z5EK/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1591","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2369630","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9329.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-40908","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9330.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9338","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9338.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:9329","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:9330","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2025-3081/suse-ru-202503081-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40908","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501885-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243902","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501885-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501886-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-40908","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/30071726/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7632-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-40908","title":"YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified","description":"YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified","status":"published","published":"2025-06-01T13:41:48.168Z","modified":"2025-06-02T03:22:25.333Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:32:34.434755Z"}],"euvd":[{"id":"EUVD-2025-16577","description":"YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified","status":"published","published":"2025-06-01T13:41:48Z","modified":"2025-06-02T03:22:25Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T20:32:33.750801Z"}],"ghsa":[{"id":"GHSA-jh9m-3m95-c6hp","title":"YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified","description":"YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified","status":"published","published":"2025-06-01T15:30:21Z","modified":"2025-06-02T06:31:38Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T15:02:32.017383Z"}],"nvd":[{"id":"CVE-2025-40908","description":"YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified","status":"published","published":"2025-06-01T14:15:21.113Z","modified":"2026-06-17T09:22:16.177Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:11:10.143444Z"}],"osv":[{"id":"CVE-2025-40908","title":"YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified","description":"YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified","status":"published","published":"2025-06-01T13:41:48.168Z","modified":"2026-10-28T02:30:47.831581404Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T15:44:49.394967Z"},{"id":"DEBIAN-CVE-2025-40908","description":"YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified","status":"published","published":"2025-06-01T14:15:21.113Z","modified":"2026-09-01T20:04:23.91778628Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:45:46.998514Z"},{"id":"OESA-2025-1591","title":"perl-YAML-LibYAML security update","description":"Security Fix(es):\n\nA vulnerability was found in TINITA YAML-LibYAML up to 0.902.x on Perl. It has been classified as problematic.CWE is classifying the issue as CWE-552. The product makes files or directories accessible to unauthorized actors, even though they should not be.This is going to have an impact on confidentiality.Upgrading to version 0.903.0 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-40908)","status":"published","published":"2025-06-06T11:08:41Z","modified":"2026-08-18T01:18:50.647751822Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"RHSA-2025:9329","title":"Red Hat Security Advisory: perl-YAML-LibYAML security update","status":"published","published":"2025-06-23T10:03:47Z","modified":"2026-06-30T10:30:43Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:9330","title":"Red Hat Security Advisory: perl-YAML-LibYAML security update","status":"published","published":"2025-06-23T10:03:48Z","modified":"2026-06-30T10:30:44Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:9338","title":"Red Hat Security Advisory: perl-YAML-LibYAML security update","status":"published","published":"2025-06-23T10:03:52Z","modified":"2026-06-30T10:30:44Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RLSA-2025:9329","title":"Important: perl-YAML-LibYAML security update","description":"Kirill Siminov's \"libyaml\" is arguably the best YAML implementation. The C library is written precisely to the YAML 1.1 specification. It was originally bound to Python and was later bound to Ruby.\n\nSecurity Fix(es):\n\n* yaml-libyaml: LibYAML Perl File Modification Vulnerability (CVE-2025-40908)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:39:03.816508Z","modified":"2025-07-29T15:00:29.597721Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:9330","title":"Important: perl-YAML-LibYAML security update","description":"Kirill Siminov's \"libyaml\" is arguably the best YAML implementation. The C library is written precisely to the YAML 1.1 specification. It was originally bound to Python and was later bound to Ruby.\n\nSecurity Fix(es):\n\n* yaml-libyaml: LibYAML Perl File Modification Vulnerability (CVE-2025-40908)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:52.256858Z","modified":"2025-10-07T17:40:39.567599Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2025-40908","description":"YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified","status":"published","published":"2025-06-01T14:15:00Z","modified":"2026-02-04T04:22:29.816186Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:55:46.53147Z"},{"id":"ALSA-2025:9329","title":"Important: perl-YAML-LibYAML security update","description":"Kirill Siminov's \"libyaml\" is arguably the best YAML implementation. The C library is written precisely to the YAML 1.1 specification. It was originally bound to Python and was later bound to Ruby.  \n\nSecurity Fix(es):  \n\n  * yaml-libyaml: LibYAML Perl File Modification Vulnerability (CVE-2025-40908)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-23T00:00:00Z","modified":"2026-10-29T11:02:28.45203316Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2025:9330","title":"Important: perl-YAML-LibYAML security update","description":"Kirill Siminov's \"libyaml\" is arguably the best YAML implementation. The C library is written precisely to the YAML 1.1 specification. It was originally bound to Python and was later bound to Ruby.  \n\nSecurity Fix(es):  \n\n  * yaml-libyaml: LibYAML Perl File Modification Vulnerability (CVE-2025-40908)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-23T00:00:00Z","modified":"2026-10-29T11:32:30.181796748Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"AZL-62242","title":"CVE-2025-40908 affecting package perl-YAML-LibYAML for versions less than 0.902.0-2","description":"YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified","status":"published","published":"2025-06-01T14:15:21Z","modified":"2026-04-21T04:51:51.412188Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"AZL-62279","title":"CVE-2025-40908 affecting package perl-YAML-LibYAML 0.81-3","description":"YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified","status":"published","published":"2025-06-01T14:15:21Z","modified":"2026-04-21T04:31:58.262358Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"MGASA-2025-0275","title":"Updated perl-YAML-LibYAML packages fix security vulnerability","description":"YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing\nexisting files to be modified. (CVE-2025-40908)\n","status":"published","published":"2025-11-12T21:29:34Z","modified":"2026-04-16T04:43:19.838532595Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15261-1","title":"perl-YAML-LibYAML-0.904.0-2.1 on GA media","description":"These are all security issues fixed in the perl-YAML-LibYAML-0.904.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:33.603563Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2025-40908","title":"CVE-2025-40908 in libyaml-libyaml-perl - Patched by Root","description":"Root has patched CVE-2025-40908 in the libyaml-libyaml-perl package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T09:40:03Z","modified":"2026-08-20T10:45:14.596832935Z","updated_at":"2026-11-02T15:53:29.631993Z"},{"id":"SUSE-RU-2025:03081-1","title":"Recommended update for perl-YAML-LibYAML","description":"This update for perl-YAML-LibYAML fixes the following issues:\n\n- Updated to 0.904.0\n- Dependency submission for the openQA stack\n","status":"published","published":"2025-09-05T06:58:53Z","modified":"2026-02-04T03:28:27.275428Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2025:01885-1","title":"Security update for perl-YAML-LibYAML","description":"This update for perl-YAML-LibYAML fixes the following issues:\n\n  - CVE-2025-40908: YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified (bsc#1243902)\n","status":"published","published":"2025-06-11T05:42:49Z","modified":"2026-02-04T02:37:39.609003Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01885-2","title":"Security update for perl-YAML-LibYAML","description":"This update for perl-YAML-LibYAML fixes the following issues:\n\n  - CVE-2025-40908: YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified (bsc#1243902)\n","status":"published","published":"2025-07-10T11:50:44Z","modified":"2026-02-04T02:16:21.493296Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01886-1","title":"Security update for perl-YAML-LibYAML","description":"This update for perl-YAML-LibYAML fixes the following issues:\n\n  - CVE-2025-40908: YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified (bsc#1243902)\n","status":"published","published":"2025-06-11T05:42:58Z","modified":"2026-02-04T03:02:40.593707Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"USN-7632-1","title":"libyaml-libyaml-perl vulnerability","description":"It was discovered that YAML-LibYAML incorrectly handled certain file\nnames. An attacker could possibly use this issue to overwrite arbitrary\nfiles.","status":"published","published":"2025-07-09T15:06:21Z","modified":"2026-04-27T18:09:14.171702Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}