{"id":"CVE-2026-63676","aliases":["DEBIAN-CVE-2026-63676","MGASA-2026-0426","OESA-2026-3237","OESA-2026-3238","OESA-2026-3239","OESA-2026-3240","OESA-2026-3406","UBUNTU-CVE-2026-63676","USN-8925-1","openSUSE-SU-2026:11321-1"],"status":"published","title":"Updated perl-YAML packages fix a security vulnerability","description":"Updated packages fixes CVE-2026-63676","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-07-21T00:00:00Z","modified":"2026-10-17T13:00:32Z","fixes":[{"ecosystem":"Debian:14","package":"libyaml-perl","fixed_in":["1.321-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"perl-YAML","fixed_in":["1.310.0-2.1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-YAML","fixed_in":["1.300.0-3.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-YAML","fixed_in":["1.26-7.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-YAML","fixed_in":["1.321-1.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-YAML","fixed_in":["1.321-1.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-YAML","fixed_in":["1.321-1.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-YAML","fixed_in":["1.321-1.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libyaml-perl","fixed_in":["1.15-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libyaml-perl","fixed_in":["1.24-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libyaml-perl","fixed_in":["1.30-1ubuntu0.20.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libyaml-perl","fixed_in":["1.30-1ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libyaml-perl","fixed_in":["1.31-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libyaml-perl","fixed_in":["1.31-1ubuntu0.26.04.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-YAML","fixed_in":["1.320.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30-2","1.31-1","1.321-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.31-1","1.321-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.321-1"}]}],"versions":["1.31-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-YAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.310.0-2.1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-YAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300.0-3.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-YAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26-7.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-YAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.321-1.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-YAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.321-1.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-YAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.321-1.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-YAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.321-1.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu0.1~esm1"}]}],"versions":["1.13-1","1.15-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-1ubuntu0.1~esm1"}]}],"versions":["1.21-1","1.24-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30-1ubuntu0.20.04.1~esm1"}]}],"versions":["1.29-1","1.30-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30-1ubuntu0.22.04.1"}]}],"versions":["1.30-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-1ubuntu0.24.04.1"}]}],"versions":["1.30-2","1.31-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.31-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-1ubuntu0.26.04.1~esm1"}]}],"versions":["1.31-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu0.1~esm1"}]}],"versions":["1.13-1","1.15-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-1ubuntu0.1~esm1"}]}],"versions":["1.21-1","1.24-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30-1ubuntu0.20.04.1~esm1"}]}],"versions":["1.29-1","1.30-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30-1ubuntu0.22.04.1"}]}],"versions":["1.30-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-1ubuntu0.24.04.1"}]}],"versions":["1.30-2","1.31-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libyaml-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-1ubuntu0.26.04.1~esm1"}]}],"versions":["1.31-1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-YAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.320.0-1.1"}]}]}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2026-63676","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0426.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35996","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/J2RXBIKA5WZB2UEHKQR7MEKDH6GABEFL/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3237","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63676","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3238","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3239","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3240","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3406","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-63676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63676","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8925-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-20285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25777","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63676","tags":["web"]}],"sources":{"osv":[{"id":"OESA-2026-3237","title":"perl-YAML security update","description":"The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.\n\nSecurity Fix(es):\n\nThe MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)","status":"published","published":"2026-08-07T09:13:13Z","modified":"2026-08-18T01:21:27.714151405Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3238","title":"perl-YAML security update","description":"The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.\n\nSecurity Fix(es):\n\nThe MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)","status":"published","published":"2026-08-07T09:17:00Z","modified":"2026-08-18T01:21:27.7435053Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3239","title":"perl-YAML security update","description":"The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.\n\nSecurity Fix(es):\n\nThe MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)","status":"published","published":"2026-08-07T09:19:43Z","modified":"2026-08-18T01:21:27.394722026Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3240","title":"perl-YAML security update","description":"The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.\n\nSecurity Fix(es):\n\nThe MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)","status":"published","published":"2026-08-07T09:23:03Z","modified":"2026-08-18T01:21:27.705383472Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3406","title":"perl-YAML security update","description":"The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.\r\n\r\nSecurity Fix(es):\n\nThe MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)","status":"published","published":"2026-08-20T09:54:32Z","modified":"2026-08-20T10:15:06.402193689Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"DEBIAN-CVE-2026-63676","status":"published","published":"2026-08-25T19:47:26.378316261Z","modified":"2026-09-02T10:00:07.145651175Z","updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"MGASA-2026-0426","title":"Updated perl-YAML packages fix a security vulnerability","description":"Updated packages fixes CVE-2026-63676\n","status":"published","published":"2026-09-20T04:25:32Z","modified":"2026-09-20T04:30:03.582863788Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11321-1","title":"perl-YAML-1.320.0-1.1 on GA media","description":"These are all security issues fixed in the perl-YAML-1.320.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-21T00:00:00Z","modified":"2026-07-22T09:30:07.452529508Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"UBUNTU-CVE-2026-63676","description":"backtracking leading to exponential load time","status":"published","published":"2026-08-27T00:00:00Z","modified":"2026-10-17T13:00:32.502623293Z","updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"USN-8925-1","title":"libyaml-perl vulnerabilities","description":"Dominique Dumont discovered that YAML-LibYAML did not correctly handle\ncertain reflection operations. If a user or system were tricked into\nopening a specially crafted file, an attacker could possibly use this issue\nto delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04\nLTS. (CVE-2017-20285)\n\nIt was discovered that YAML-LibYAML did not correctly handle parsing\ncertain documents. If a user or automated system were tricked into opening\na specially crafted file, an attacker could possibly use this issue to\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2019-25777)\n\nIt was discovered that YAML-LibYAML contained a regular expression\nsusceptible to catastrophic backtracking. If a user or automated system\nwere tricked into opening a specially crafted file, an attacker could\npossibly use this issue to cause a denial of service. (CVE-2026-63676)","status":"published","published":"2026-10-14T03:31:33Z","modified":"2026-10-14T11:57:58.298079668Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}