YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.
The heap overflow occurs when class names exceed the initial 512-byte allocation.
The base64 decoder could read past the buffer end on trailing newlines.
strtok mutated n->type_id in place, corrupting shared node data.
A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.
References
Configurations
No configuration.
History
17 Mar 2026, 14:20
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
17 Mar 2026, 02:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
16 Mar 2026, 23:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-16 23:16
Updated : 2026-03-17 14:20
NVD link : CVE-2026-4177
Mitre link : CVE-2026-4177
CVE.ORG link : CVE-2026-4177
JSON object : View
Products Affected
No product.
CWE
CWE-122
Heap-based Buffer Overflow