Out-of-Bounds Read Vulnerability in Perl's YAML::Syck Affects Key Handling

CVE-2025-11683

What is CVE-2025-11683?

The YAML::Syck module for Perl is susceptible to an out-of-bounds read due to missing null-terminators in its token handling logic. This vulnerability potentially exposes adjacent variables when processing complex YAML files that contain hashed keys with empty values. Although the flaw does not directly indicate access to memory outside the allocated space of the module, it raises concerns about information disclosure in certain use cases. Developers utilizing YAML::Syck versions prior to 1.36 should review security implications and apply necessary updates or patches to safeguard their applications.

References