Description
YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.

In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.

Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.
Published: 2026-07-16
Score: 6.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a use‑after‑free and double‑free flaw in YAML::Syck, a Perl YAML parser, that occurs when an anchor node is freed while still present on the parser value stack. This flaw is triggered by redefining or removing an anchor during parsing, which causes the interpreter to abort. The result is a denial of service against any Perl process that loads untrusted YAML data, as the crash terminates the program or could be exploited to cause broader disruption.

Affected Systems

The flaw affects the TODDR YAML::Syck library for Perl, specifically all releases prior to version 1.47. Users of any earlier versions who call the Load or LoadFile functions on externally supplied YAML documents are at risk.

Risk and Exploitability

The CVSS score is 6.2, indicating a moderate severity denial of service; the EPSS score is below 1%, suggesting low likelihood of active exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers can deliver a crafted YAML document that redefines an anchor during parsing, causing the interpreter to crash. The issue is identified by CWE‑1341, CWE‑415, and CWE‑416.

Generated by OpenCVE AI on July 31, 2026 at 01:14 UTC.

Remediation

Vendor Solution

Upgrade to YAML-Syck 1.47 or later.

OpenCVE Recommended Actions

  • Apply the official update to upgrade YAML::Syck to version 1.47 or later
  • If an update is not immediately feasible, limit the use of Load or LoadFile to trusted inputs and isolate the parser in a sandboxed or separate process to contain crashes
  • If both strategies are unavailable, monitor the application for interpreter termination, log malformed YAML attempts, and consider validating input with an alternative, unaffected YAML parser

Generated by OpenCVE AI on July 31, 2026 at 01:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 18 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1341
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 17 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 16 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Toddr
Toddr yaml::syck
Vendors & Products Toddr
Toddr yaml::syck

Thu, 16 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.
Title YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack
Weaknesses CWE-415
CWE-416
References

Subscriptions

Toddr Yaml::syck
cve-icon MITRE

Status: PUBLISHED

Assigner: CPANSec

Published:

Updated: 2026-07-17T13:18:02.930Z

Reserved: 2026-06-29T13:57:19.498Z

Link: CVE-2026-13713

cve-icon Vulnrichment

Updated: 2026-07-17T03:02:25.421Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-16T21:35:31Z

Links: CVE-2026-13713 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T01:15:18Z

Weaknesses