YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure
Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read
The issue is seen with complex YAML files with a hash of all keys and empty values. There is no indication that the issue leads to accessing memory outside that allocated to the module.
References
| Link | Resource |
|---|---|
| https://github.com/cpan-authors/YAML-Syck/pull/65 | Issue Tracking |
| https://metacpan.org/dist/YAML-Syck/changes | Product Release Notes |
Configurations
History
09 Mar 2026, 15:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/cpan-authors/YAML-Syck/pull/65 - Issue Tracking | |
| References | () https://metacpan.org/dist/YAML-Syck/changes - Product, Release Notes | |
| CPE | cpe:2.3:a:toddr:yaml\:\:syck:*:*:*:*:*:perl:*:* | |
| First Time |
Toddr yaml\
Toddr |
16 Oct 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
16 Oct 2025, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-16 01:15
Updated : 2026-03-09 15:05
NVD link : CVE-2025-11683
Mitre link : CVE-2025-11683
CVE.ORG link : CVE-2025-11683
JSON object : View
Products Affected
toddr
- yaml\
CWE
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer