PT-2026-60595 · Toddr · Yaml::Syck

CVE-2026-57077 · Publicado 2026-07-16 · Atualizado 2026-07-16

Mitre

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline len.

In the bundled libsyck newline len and is newline dereference the scan pointer, and the following byte for a "r " pair, with no NUL-terminator or bounds check. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover.

Any caller that runs Load or LoadFile on an untrusted document with a block scalar at a document boundary reaches the over-read.

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2026-57077

Produtos afetados

Yaml::Syck

Referências · 4

• https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch · Correção
• https://cve.org/CVERecord?id=CVE-2025-11683 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-57077 · Nota de Segurança
• https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes · Nota