Most recent entries from all

ALSA-2026:6470 — Important: perl-YAML-Syck security update

Affected: AlmaLinux:8: perl-YAML-Syck

This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around.

Security Fix(es):

* perl-YAML-Syck: YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter (CVE-2026-4177)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BELL-CVE-2026-4177

Affected: Alpaquita:23: perl-yaml-syck, Alpaquita:25: perl-yaml-syck, Alpaquita:stream: perl-yaml-syck

EUVD-2026-337247

fkie_cve-2026-4177

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.

The heap overflow occurs when class names exceed the initial 512-byte allocation.

The base64 decoder could read past the buffer end on trailing newlines.

strtok mutated n->type_id in place, corrupting shared node data.

A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.

GHSA-72r6-p2x3-g9gj

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.

The heap overflow occurs when class names exceed the initial 512-byte allocation.

The base64 decoder could read past the buffer end on trailing newlines.

strtok mutated n->type_id in place, corrupting shared node data.

A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.

openSUSE-SU-2026:10551-1 — perl-YAML-Syck-1.440.0-1.1 on GA media

perl-YAML-Syck-1.440.0-1.1 on GA media

RHSA-2026:8311 — Red Hat Security Advisory: perl-YAML-Syck security update

perl-YAML-Syck: YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter

UBUNTU-CVE-2026-4177

Affected: Ubuntu:Pro:16.04:LTS: libyaml-syck-perl, Ubuntu:Pro:18.04:LTS: libyaml-syck-perl, Ubuntu:Pro:20.04:LTS: libyaml-syck-perl, Ubuntu:Pro:22.04:LTS: libyaml-syck-perl, Ubuntu:Pro:24.04:LTS: libyaml-syck-perl, Ubuntu:25.10: libyaml-syck-perl, Ubuntu:26.04:LTS: libyaml-syck-perl

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. The heap overflow occurs when class names exceed the initial 512-byte allocation. The base64 decoder could read past the buffer end on trailing newlines. strtok mutated n->type_id in place, corrupting shared node data. A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.

WID-SEC-W-2026-0939 — cPanel cPanel/WHM (perl-YAML-Syck): Schwachstelle ermöglicht Codeausführung und DoS

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in cPanel cPanel/WHM ausnutzen, um potenziell beliebigen Code auszuführen oder einen Denial-of-Service-Zustand zu verursachen.