The flaw in libfyaml 0.9.6 occurs during parsing of YAML documents that contain a very large literal or folded block scalar. The parser function repeatedly grows an internal buffer using alloca() inside a loop and does not release the stack memory until the function returns. This cumulative stack growth can exceed the process stack limit, causing a segmentation fault and terminating the application. The vulnerability leads to a denial of service rather than code execution or data exposure.

Any software that embeds libfyaml version 0.9.6 is susceptible. The vendor or product names are not listed, so any project or application using this specific library version, regardless of platform, is at risk. Up‑to‑date versions of libfyaml are not affected as the issue exists only in 0.9.6.

The EPSS score is less than 1% and the CVSS score is 6.5, indicating a medium severity. The vulnerability is not listed in CISA KEV, but the denial‑of‑service impact could be significant for production services that rely on YAML parsing. The likely attack vector involves an attacker supplying a crafted YAML file to a vulnerable application. Because the vulnerability is triggered by input size, an adversary can intentionally create a payload that forces stack exhaustion, causing the target process to crash. The denial‑of‑service risk remains high for impacted deployments.