CVE-2026-57077

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len

Published Jul 16, 2026 CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Description

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len.

In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover.

Any caller that runs Load or LoadFile on an untrusted document with a block scalar at a document boundary reaches the over-read.

Analysis

Technical impact

YAML::Syck versions before 1.47 contain an out‑of‑bounds read caused by an unbounded newline scan during block‑scalar lexing. The lexer dereferences a pointer one byte beyond the heap buffer when encountering a block scalar at a document boundary, exposing data located beyond the intended buffer. This flaw can leak sensitive information to an attacker, as it is classified as CWE‑125.

Affected Systems

The affected product is YAML‑Syck for Perl, published by the vendor TODDR. All releases prior to version 1.47 are susceptible; version 1.47 and later include the fix.

Risk and Exploitability

The vulnerability has a CVSS score of 7.7, indicating high risk of information disclosure. Its EPSS score of less than 1 % and lack of listing in KEV suggest a low current exploitation probability, though the severity remains significant. An attacker must supply an untrusted YAML document containing a block scalar at a document boundary, which when processed by the vulnerable module via Load or LoadFile leads to an out‑of‑bounds read that can expose adjacent memory contents. The exploit relies on the lexer path that was not fully addressed by the earlier fix for CVE‑2025‑11683, meaning the same scenario applies to earlier patched versions that did not cover this path.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

TODDR

YAML::Syck

unaffected

Version	Status	Constraints
`0`	affected	< 1.47

No data.

Vendor Product Versions

Toddr

Yaml::syck

Version	Status	Scheme	Platform
`[0,1.47)`	affected	generic	—

Remediation

Vendor Solution

Upgrade to YAML-Syck 1.47 or later.

OpenCVE Recommended Actions

Upgrade the YAML::Syck Perl module to version 1.47 or later, the vendor’s official fix.
If an upgrade cannot be applied immediately, filter or reject any YAML input that contains block scalars at document boundaries before passing it to Load or LoadFile, preventing the lexer from executing the vulnerable path.
If additional protection is desired, consider using an alternative YAML parser that validates input size and follows safe parsing practices until the upgrade is in place.

Generated by OpenCVE AI on July 31, 2026 at 01:13 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4730-1	libyaml-syck-perl security update
Debian DSA	DSA-6428-1	libyaml-syck-perl security update

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.188% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch
https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes
https://nvd.nist.gov/vuln/detail/CVE-2026-57077
https://www.cve.org/CVERecord?id=CVE-2025-11683
https://www.cve.org/CVERecord?id=CVE-2026-57077

History

Jul 18, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-57077 https://www.cve.org/CVERecord?id=CVE-2026-57077
Metrics	threat_severity `None`	threat_severity `Moderate`

Jul 17, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 16, 2026 11:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Toddr Toddr yaml::syck
Vendors & Products		Toddr Toddr yaml::syck

Jul 16, 2026 10:15 PM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover. Any caller that runs Load or LoadFile on an untrusted document with a block scalar at a document boundary reaches the over-read.
Title		YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len
Weaknesses		CWE-125
References		https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes https://www.cve.org/CVERecord?id=CVE-2025-11683