PT-2026-60595 · Toddr · Yaml::Syck
CVE-2026-57077
·
Published
2026-07-16
·
Updated
2026-07-16
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline len.
In the bundled libsyck newline len and is newline dereference the scan pointer, and the following byte for a "r
" pair, with no NUL-terminator or bounds check. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover.
Any caller that runs Load or LoadFile on an untrusted document with a block scalar at a document boundary reaches the over-read.
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Yaml::Syck