Skip to content
fr Sign in
7.8 High

CVE-2026-57076 YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key…

Description

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor. In the bundled libsyck an anchor name allocated by syck_strndup is stored both as node->anchor, freed when the node is freed, and as the key in the parser's anchors table. Freeing the node frees the shared key, and a later anchor redefinition makes st_delete compare against the freed key, so st_strcmp reads freed heap memory. Anchors are a standard YAML feature and need no special flags, so this is reached on the default Load path. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor reaches the read of freed memory.

Affected products and versions

Product Affected versions Fixed in
YAML::Syck 1.47 earliest → < 1.47 1.47

References

Timeline

  1. Published
  2. Last modified

Other CVEs of YAML::Syck

The 7 CVEs of YAML::Syck →
CVE-2026-57077 YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len 7.7 High CVE-2026-57075 YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in… 9.1 Critical CVE-2026-13713 YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still… 6.2 Medium CVE-2026-5089 YAML::Syck versions before 1.38 for Perl has an out-of-bounds read 7.3 High
Track this CVE