CVE-2026-57076

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor

View on CVE.org

Published Jul 16, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor.

In the bundled libsyck an anchor name allocated by syck_strndup is stored both as node->anchor, freed when the node is freed, and as the key in the parser's anchors table. Freeing the node frees the shared key, and a later anchor redefinition makes st_delete compare against the freed key, so st_strcmp reads freed heap memory. Anchors are a standard YAML feature and need no special flags, so this is reached on the default Load path.

Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor reaches the read of freed memory.

Analysis

Technical impact

YAML::Syck versions before 1.47 contain a heap use‑after‑free that occurs when an anchor name is reused as an anchors‑table key in syck_hdlr_add_anchor. When the node carrying that anchor is freed, the shared key is also freed, and a subsequent anchor redefinition uses st_strcmp to compare against freed memory, resulting in a use‑after‑free that can corrupt heap memory. The CVE description states that this flaw is reached on the default Load path when an application loads untrusted YAML documents. The flaw is thus a memory‑corruption vulnerability without an explicit claim of arbitrary code execution.

Affected Systems

Vendor Toddr provides the YAML::Syck library. All releases prior to version 1.47 are affected. Applications that embed Perl with YAML::Syck below this version and that accept untrusted YAML input at runtime are vulnerable. Based on the description, the vulnerability is triggered when an application uses the default Load or LoadFile path to parse untrusted YAML.

Risk and Exploitability

The CVSS score of 7.8 classifies this issue as high severity. The EPSS score is less than 1 %, indicating a very low current exploitation probability in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an application supplying a malicious YAML document that redefines an anchor, triggering the use‑after‑free and potentially corrupting program memory.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

TODDR

YAML::Syck

unaffected

Version	Status	Constraints
`0`	affected	< 1.47

No data.

Vendor Product Versions

Toddr

Yaml::syck

Version	Status	Scheme	Platform
`[0,1.47)`	affected	generic	—

Remediation

Vendor Solution

Upgrade to YAML-Syck 1.47 or later.

OpenCVE Recommended Actions

Upgrade to YAML‑Syck 1.47 or later to remove the use‑after‑free bug.
Avoid loading untrusted YAML documents with Load or LoadFile; consider using safer parsing mechanisms or sandboxing the parsing process.
Validate or sanitize input YAML before parsing to prevent anchor redefinitions or other malformed constructs that could trigger the flaw.

Generated by OpenCVE AI on July 31, 2026 at 01:13 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4730-1	libyaml-syck-perl security update
Debian DSA	DSA-6428-1	libyaml-syck-perl security update

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.168% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/07/17/3
https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch
https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes
https://nvd.nist.gov/vuln/detail/CVE-2026-57076
https://www.cve.org/CVERecord?id=CVE-2026-57076

History

Jul 18, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-57076 https://www.cve.org/CVERecord?id=CVE-2026-57076
Metrics	threat_severity `None`	threat_severity `Moderate`

Jul 17, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 16, 2026 11:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Toddr Toddr yaml::syck
Vendors & Products		Toddr Toddr yaml::syck

Jul 16, 2026 10:15 PM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor. In the bundled libsyck an anchor name allocated by syck_strndup is stored both as node->anchor, freed when the node is freed, and as the key in the parser's anchors table. Freeing the node frees the shared key, and a later anchor redefinition makes st_delete compare against the freed key, so st_strcmp reads freed heap memory. Anchors are a standard YAML feature and need no special flags, so this is reached on the default Load path. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor reaches the read of freed memory.
Title		YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor
Weaknesses		CWE-416
References		https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes