CVE-2026-4177 PUBLISHED

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter

Assigner: CPANSec
Reserved: 14.03.2026 Published: 16.03.2026 Updated: 17.03.2026

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.

The heap overflow occurs when class names exceed the initial 512-byte allocation.

The base64 decoder could read past the buffer end on trailing newlines.

strtok mutated n->type_id in place, corrupting shared node data.

A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.

Product Status

Vendor TODDR
Product YAML::Syck
Versions Default: unaffected
  • affected from 0 to 1.36 (incl.)

Solutions

Upgrade to version 1.37 or higher.

Credits

  • Todd Rinaldo finder

References

Problem Types

  • CWE-122 Heap-based Buffer Overflow CWE