{"id":"CVE-2026-13713","aliases":["ALPINE-CVE-2026-13713","ALSA-2026:67269","AZL-109520","AZL-92904","BELL-CVE-2026-13713","DEBIAN-CVE-2026-13713","EUVD-2026-45052","GHSA-p3p9-6pr6-mr9m","MGASA-2026-0367","RHSA-2026:67269","RLSA-2026:67269","UBUNTU-CVE-2026-13713","openSUSE-SU-2026:11299-1","openSUSE-SU-2026:21452-1","openSUSE-SU-2026:21497-1"],"status":"published","title":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack","description":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.\n\nIn the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.\n\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00179,"percentile":0.07491,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415","CWE-416"],"published":"2026-07-16T21:35:31Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"perl-yaml-syck","fixed_in":["1.47-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"perl-YAML-Syck","fixed_in":["1.30-7.el8_10"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"perl-yaml-syck","fixed_in":["1.34-r5"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"perl-yaml-syck","fixed_in":["1.34-r8"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"perl-yaml-syck","fixed_in":["1.47-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libyaml-syck-perl","fixed_in":["1.34-2+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libyaml-syck-perl","fixed_in":["1.34-2+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libyaml-syck-perl","fixed_in":["1.47-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-YAML-Syck","fixed_in":["0:1.30-7.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-YAML-Syck-debuginfo","fixed_in":["0:1.30-7.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-YAML-Syck-debugsource","fixed_in":["0:1.30-7.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"perl-YAML-Syck","fixed_in":["0:1.30-7.el8_10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl-yaml-syck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.47-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-YAML-Syck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30-7.el8_10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-YAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-YAML-Syck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.34-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"perl-yaml-syck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34-r2"},{"fixed":"1.34-r5"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"perl-yaml-syck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34-r5"},{"fixed":"1.34-r8"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"perl-yaml-syck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34-r1"},{"fixed":"1.47-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libyaml-syck-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-2+deb12u3"}]}],"versions":["1.34-2","1.34-2+deb12u1","1.34-2+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"libyaml-syck-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-2+deb13u3"}]}],"versions":["1.34-2","1.34-2+deb13u1","1.34-2+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"libyaml-syck-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.47-1"}]}],"versions":["1.34-2","1.34-3","1.34-4","1.36-1","1.36-2","1.36-3"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-YAML-Syck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.470.0-1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:9","package":"perl-YAML-Syck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.470.0-1.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-YAML-Syck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30-7.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-YAML-Syck-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30-7.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-YAML-Syck-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30-7.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-YAML-Syck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30-7.el8_10"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libyaml-syck-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.27-2build2","1.29-1","1.29-1build1","1.29-1ubuntu0.16.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libyaml-syck-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.29-1build3","1.29-1ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libyaml-syck-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.31-1","1.31-1build1","1.31-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libyaml-syck-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34-1build1","1.34-1build2","1.34-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libyaml-syck-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34-2","1.34-2build1","1.34-2build2","1.34-2build3","1.34-2ubuntu0.24.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libyaml-syck-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.36-1","1.36-3","1.47-1","1.47-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libyaml-syck-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34-3","1.34-4","1.36-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-YAML-Syck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.470.0-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-YAML-Syck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.470.0-bp160.1.1"}]}],"bundled":5}],"products":[{"vendor":"toddr","product":"yaml::syck"}],"references":[{"url":"https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes","tags":["release-notes","advisory","web","article","report"]},{"url":"https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch","tags":["patch","fix","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/17/1","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13713","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-p3p9-6pr6-mr9m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-13713","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67269","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13713","tags":["report"]},{"url":"https://bugzilla.redhat.com/2501564","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-67269.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-13713","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13713.json","tags":["advisory"]},{"url":"https://github.com/toddr/YAML-Syck","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-13713","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0367.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35949","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/17/1","tags":["web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/17/2","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/17/3","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/17/4","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2501564","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67269.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13713","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:67269","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-13713","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57077","tags":["web"]},{"url":"https://bugzilla.suse.com/1271631","tags":["report"]},{"url":"https://bugzilla.suse.com/1271632","tags":["report"]},{"url":"https://bugzilla.suse.com/1271633","tags":["report"]},{"url":"https://bugzilla.suse.com/1271634","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11683","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-13713","title":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack","description":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.\n\nIn the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.\n\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.","status":"published","published":"2026-07-16T21:35:31.477Z","modified":"2026-07-17T13:18:02.93Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-416","CWE-415"],"updated_at":"2026-11-02T14:19:50.24628Z"}],"euvd":[{"id":"EUVD-2026-45052","description":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.\n\nIn the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.\n\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.","status":"published","published":"2026-07-16T21:35:31Z","modified":"2026-07-17T13:18:02Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:19:50.846094Z"}],"ghsa":[{"id":"GHSA-p3p9-6pr6-mr9m","title":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor...","description":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.\n\nIn the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.\n\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.","status":"published","published":"2026-07-17T00:32:11Z","modified":"2026-07-17T15:33:28Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T15:09:35.141236Z"}],"nvd":[{"id":"CVE-2026-13713","description":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.\n\nIn the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.\n\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.","status":"published","published":"2026-07-16T22:16:59.64Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-415","CWE-416"],"updated_at":"2026-11-02T14:12:30.250437Z"}],"osv":[{"id":"ALPINE-CVE-2026-13713","description":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.\n\nIn the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.\n\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.","status":"published","published":"2026-07-16T22:16:59.64Z","modified":"2026-10-01T02:17:49.180799661Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-13713","status":"published","published":"2026-07-18T06:03:10.173171Z","modified":"2026-07-28T07:15:13.105499126Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-13713","title":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack","description":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.\n\nIn the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.\n\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.","status":"published","published":"2026-07-16T21:35:31.477Z","modified":"2026-10-28T02:30:35.345224833Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-415","CWE-416"],"updated_at":"2026-11-02T15:44:57.354194Z"},{"id":"DEBIAN-CVE-2026-13713","description":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.  In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.  Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.","status":"published","published":"2026-07-16T22:16:59.64Z","modified":"2026-10-25T09:47:40.567663281Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:51.374409Z"},{"id":"RHSA-2026:67269","title":"Red Hat Security Advisory: perl-YAML-Syck security update","status":"published","published":"2026-09-14T10:10:26Z","modified":"2026-09-15T10:17:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:67269","title":"Important: perl-YAML-Syck security update","description":"This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around.\n\nSecurity Fix(es):\n\n* YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document (CVE-2026-13713)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-15T06:02:28.349697Z","modified":"2026-09-15T06:30:02.552007165Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-13713","description":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.","status":"published","published":"2026-07-16T22:16:00Z","modified":"2026-10-17T12:58:46.325750867Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"ALSA-2026:67269","title":"Important: perl-YAML-Syck security update","description":"This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around.  \n\nSecurity Fix(es):  \n\n  * YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document (CVE-2026-13713)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-10-29T11:02:29.358777813Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-109520","title":"CVE-2026-13713 affecting package perl-YAML 1.30-2","description":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.\n\nIn the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.\n\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.","status":"published","published":"2026-07-16T22:16:59Z","modified":"2026-10-27T05:36:16Z","updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"AZL-92904","title":"CVE-2026-13713 affecting package perl-YAML-Syck 1.34-1","description":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.\n\nIn the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.\n\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.","status":"published","published":"2026-07-16T22:16:59Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:25.880689Z"},{"id":"MGASA-2026-0367","title":"Updated perl-YAML-Syck packages fix security vulnerabilities","description":"YAML::Syck versions before 1.47 for Perl allow a use-after-free and\ndouble-free via an anchor node freed while still on the parser value\nstack\nYAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via\na signed-char lookup-table index in syck_base64dec\nYAML::Syck versions before 1.47 for Perl allow a heap use-after-free via\nan anchor name reused as an anchors-table key in syck_hdlr_add_anchor\nYAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via\nan unbounded newline scan in newline_len\n","status":"published","published":"2026-09-02T16:59:28Z","modified":"2026-09-02T17:00:05.32927146Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11299-1","title":"perl-YAML-Syck-1.470.0-1.1 on GA media","description":"These are all security issues fixed in the perl-YAML-Syck-1.470.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-17T00:00:00Z","modified":"2026-07-18T08:45:07.171775832Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21452-1","title":"Security update for perl-YAML-Syck","description":"This update for perl-YAML-Syck fixes the following issues:\n\nChanges in perl-YAML-Syck:\n\n- updated to 1.470.0 (1.47)\n    [Security]\n    - Fix four libsyck memory-safety CVEs reachable from the default\n      YAML::Syck::Load() path on untrusted input with no special flags\n      (reported by Paul Johnson via CPANSec, PR #213):\n      - CVE-2026-57075 (CWE-125): out-of-bounds read in the base64 decoder\n        caused by signed-char indexing of the decode table on !!binary input\n        bsc#1271632\n      - CVE-2026-57076 (CWE-416): use-after-free of an anchor key string\n        shared between the node and the anchors table\n        bsc#1271633\n      - CVE-2026-57077 (CWE-125): one-byte out-of-bounds read in the lexer\n        newline scan during block-scalar parsing (incomplete-fix follow-on\n        to CVE-2025-11683)\n        bsc#1271634\n      - CVE-2026-13713 (CWE-416/CWE-415): use-after-free / double-free of an\n        anchor node on anchor redefinition, a remote-crash DoS from a\n        7-byte input\n        bsc#1271631\n    - Harden syck_base64dec() to bounds-check each read so it cannot run past\n      a non-NUL-terminated input buffer (defense-in-depth for callers passing\n      raw buffers; PR #213)\n    [Bug Fixes]\n    - Fix: enforce $MaxDepth on Load to prevent C-stack exhaustion from\n      deeply nested YAML/JSON input; YAML::Syck and JSON::Syck Load now\n      default to 512, matching Dump (PR #204)\n    - Fix: emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values\n      in Dump so they roundtrip with ImplicitTyping instead of reloading as\n      plain strings (PR #201)\n    [Maintenance]\n    - CI: add an AddressSanitizer job that builds the XS with\n      -fsanitize=address and runs the suite plus the CVE trigger inputs to\n      catch libsyck memory-safety defects; de-pin the libasan version so it\n      tracks the runner's GCC (PR #213)\n\n- updated to 1.460.0 (1.46)\n    [Bug Fixes]\n    - Fix: preserve string nature of numeric-looking values in Dump; pure\n      strings (POK only, no IOK/NOK) are now quoted to maintain roundtrip\n      fidelity (GH #199, PR #200)\n    - Fix: accept trailing commas in flow sequences and mappings\n      ([a, b,] and {a: 1,}), valid per YAML 1.0/1.1/1.2 spec\n      (GH #195, PR #196)\n\n    [Maintenance]\n    - CI: upgrade install-with-cpm to v2 for compatibility with Perl\n      versions prior to 5.24 in perldocker containers (GH #197, PR #198)\n    - Clean up MANIFEST.SKIP: add #!include_default, remove redundant\n      entries, exclude .claude/ from distribution\n","status":"withdrawn","published":"2026-07-27T08:03:38Z","modified":"2026-07-31T14:01:33.655788484Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21497-1","title":"Security update for perl-YAML-Syck","description":"This update for perl-YAML-Syck fixes the following issues:\n\nChanges in perl-YAML-Syck:\n\n- updated to 1.470.0 (1.47)\n    [Security]\n    - Fix four libsyck memory-safety CVEs reachable from the default\n      YAML::Syck::Load() path on untrusted input with no special flags\n      (reported by Paul Johnson via CPANSec, PR #213):\n      - CVE-2026-57075 (CWE-125): out-of-bounds read in the base64 decoder\n        caused by signed-char indexing of the decode table on !!binary input\n        bsc#1271632\n      - CVE-2026-57076 (CWE-416): use-after-free of an anchor key string\n        shared between the node and the anchors table\n        bsc#1271633\n      - CVE-2026-57077 (CWE-125): one-byte out-of-bounds read in the lexer\n        newline scan during block-scalar parsing (incomplete-fix follow-on\n        to CVE-2025-11683)\n        bsc#1271634\n      - CVE-2026-13713 (CWE-416/CWE-415): use-after-free / double-free of an\n        anchor node on anchor redefinition, a remote-crash DoS from a\n        7-byte input\n        bsc#1271631\n    - Harden syck_base64dec() to bounds-check each read so it cannot run past\n      a non-NUL-terminated input buffer (defense-in-depth for callers passing\n      raw buffers; PR #213)\n    [Bug Fixes]\n    - Fix: enforce $MaxDepth on Load to prevent C-stack exhaustion from\n      deeply nested YAML/JSON input; YAML::Syck and JSON::Syck Load now\n      default to 512, matching Dump (PR #204)\n    - Fix: emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values\n      in Dump so they roundtrip with ImplicitTyping instead of reloading as\n      plain strings (PR #201)\n    [Maintenance]\n    - CI: add an AddressSanitizer job that builds the XS with\n      -fsanitize=address and runs the suite plus the CVE trigger inputs to\n      catch libsyck memory-safety defects; de-pin the libasan version so it\n      tracks the runner's GCC (PR #213)\n\n- updated to 1.460.0 (1.46)\n    [Bug Fixes]\n    - Fix: preserve string nature of numeric-looking values in Dump; pure\n      strings (POK only, no IOK/NOK) are now quoted to maintain roundtrip\n      fidelity (GH #199, PR #200)\n    - Fix: accept trailing commas in flow sequences and mappings\n      ([a, b,] and {a: 1,}), valid per YAML 1.0/1.1/1.2 spec\n      (GH #195, PR #196)\n\n    [Maintenance]\n    - CI: upgrade install-with-cpm to v2 for compatibility with Perl\n      versions prior to 5.24 in perldocker containers (GH #197, PR #198)\n    - Clean up MANIFEST.SKIP: add #!include_default, remove redundant\n      entries, exclude .claude/ from distribution\n","status":"published","published":"2026-07-29T09:24:06Z","modified":"2026-07-31T18:24:10.598985603Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}