Heap Buffer Overflow Vulnerability in YAML::Syck Affecting Perl by CPAN

CVE-2026-4177

What is CVE-2026-4177?

The YAML::Syck module for Perl is vulnerable to several security issues, including a heap buffer overflow that can be triggered when class names exceed the allocated 512 bytes. Additionally, the base64 decoder functionality may read beyond the buffer's end when handling trailing newlines. There is also a mutation of shared node data causing corruption and a memory leak during node anchoring operations, particularly when an anchor already exists. These vulnerabilities pose significant risks and should be addressed promptly.

References