PT-2025-42400 · Unknown+3 · Yaml::Syck+3

Published 2025-10-16 · Updated 2026-05-11 · CVE-2025-11683

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions YAML::Syck versions before 1.36

Description YAML::Syck, a Perl module, contains a flaw due to missing null terminators in the token.c file. This can lead to an out-of-bounds read, potentially resulting in information disclosure. The issue is observed when processing complex YAML files containing a hash of all keys and empty values. The read is limited to adjacent variables and does not appear to allow access to memory outside the module's allocated space.

Recommendations Update YAML::Syck to version 1.36 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2025-11683

OPENSUSE-SU-2026:10746-1

OPENSUSE-SU-2026:20771-1

USN-7844-1

Affected Products

Debian

Linuxmint

Ubuntu

Yaml::Syck

References · 20

• https://github.com/cpan-authors/YAML-Syck/pull/65 · Patch
• https://osv.dev/vulnerability/USN-7844-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-11683 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-11683 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-11683 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7844-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10746-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-11683 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11683 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11683 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11683 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11683 · Vendor Advisory
• https://github.com/cpan-authors/YAML-Syck/commit/dcf4c8477b82ef439f43fd20dc099082d096df02 · Note
• https://twitter.com/CVEnew/status/1978932560177828097 · Twitter Post
• https://t.me/CVEtracker/35044 · Telegram Post