Vulnerability-Lookup

RHSA-2026:67269

Vulnerability from csaf_opensuse - Published: 2026-09-14 09:06 - Updated: 2026-09-14 11:46

Summary

Red Hat Security Advisory: perl-YAML-Syck security update

Severity

Important

Notes

Topic: An update for perl-YAML-Syck is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around. Security Fix(es): * YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document (CVE-2026-13713) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-13713

A flaw was found in YAML::Syck. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted YAML document. The flaw occurs due to a use-after-free and double-free condition when an anchor node is redefined while still on the parser's value stack, leading to the interpreter crashing.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1341 - Multiple Releases of Same Resource or Handle

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.src	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

References

10 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:67269	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2501564	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-13713	self
https://bugzilla.redhat.com/show_bug.cgi?id=2501564	external
https://www.cve.org/CVERecord?id=CVE-2026-13713	external
https://nvd.nist.gov/vuln/detail/CVE-2026-13713	external
https://github.com/toddr/YAML-Syck/commit/44c90a1…	external
https://metacpan.org/release/TODDR/YAML-Syck-1.47…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for perl-YAML-Syck is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around.\n\nSecurity Fix(es):\n\n* YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document (CVE-2026-13713)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:67269",
        "url": "https://access.redhat.com/errata/RHSA-2026:67269"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2501564",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501564"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67269.json"
      }
    ],
    "title": "Red Hat Security Advisory: perl-YAML-Syck security update",
    "tracking": {
      "current_release_date": "2026-09-14T11:46:31+00:00",
      "generator": {
        "date": "2026-09-14T11:46:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.21"
        }
      },
      "id": "RHSA-2026:67269",
      "initial_release_date": "2026-09-14T09:06:14+00:00",
      "revision_history": [
        {
          "date": "2026-09-14T09:06:14+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-14T09:06:14+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-14T11:46:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux CRB (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux CRB (v. 8)",
                  "product_id": "CRB-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::crb"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-YAML-Syck-0:1.30-7.el8_10.src",
                "product": {
                  "name": "perl-YAML-Syck-0:1.30-7.el8_10.src",
                  "product_id": "perl-YAML-Syck-0:1.30-7.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-YAML-Syck@1.30-7.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-YAML-Syck-0:1.30-7.el8_10.aarch64",
                "product": {
                  "name": "perl-YAML-Syck-0:1.30-7.el8_10.aarch64",
                  "product_id": "perl-YAML-Syck-0:1.30-7.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-YAML-Syck@1.30-7.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.aarch64",
                "product": {
                  "name": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.aarch64",
                  "product_id": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-YAML-Syck-debugsource@1.30-7.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.aarch64",
                "product": {
                  "name": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.aarch64",
                  "product_id": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-YAML-Syck-debuginfo@1.30-7.el8_10?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-YAML-Syck-0:1.30-7.el8_10.ppc64le",
                "product": {
                  "name": "perl-YAML-Syck-0:1.30-7.el8_10.ppc64le",
                  "product_id": "perl-YAML-Syck-0:1.30-7.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-YAML-Syck@1.30-7.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.ppc64le",
                "product": {
                  "name": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.ppc64le",
                  "product_id": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-YAML-Syck-debugsource@1.30-7.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.ppc64le",
                "product": {
                  "name": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.ppc64le",
                  "product_id": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-YAML-Syck-debuginfo@1.30-7.el8_10?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-YAML-Syck-0:1.30-7.el8_10.x86_64",
                "product": {
                  "name": "perl-YAML-Syck-0:1.30-7.el8_10.x86_64",
                  "product_id": "perl-YAML-Syck-0:1.30-7.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-YAML-Syck@1.30-7.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.x86_64",
                "product": {
                  "name": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.x86_64",
                  "product_id": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-YAML-Syck-debugsource@1.30-7.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.x86_64",
                "product": {
                  "name": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.x86_64",
                  "product_id": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-YAML-Syck-debuginfo@1.30-7.el8_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-YAML-Syck-0:1.30-7.el8_10.s390x",
                "product": {
                  "name": "perl-YAML-Syck-0:1.30-7.el8_10.s390x",
                  "product_id": "perl-YAML-Syck-0:1.30-7.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-YAML-Syck@1.30-7.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.s390x",
                "product": {
                  "name": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.s390x",
                  "product_id": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-YAML-Syck-debugsource@1.30-7.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.s390x",
                "product": {
                  "name": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.s390x",
                  "product_id": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-YAML-Syck-debuginfo@1.30-7.el8_10?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-YAML-Syck-0:1.30-7.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.aarch64"
        },
        "product_reference": "perl-YAML-Syck-0:1.30-7.el8_10.aarch64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-YAML-Syck-0:1.30-7.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.ppc64le"
        },
        "product_reference": "perl-YAML-Syck-0:1.30-7.el8_10.ppc64le",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-YAML-Syck-0:1.30-7.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.s390x"
        },
        "product_reference": "perl-YAML-Syck-0:1.30-7.el8_10.s390x",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-YAML-Syck-0:1.30-7.el8_10.src as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.src"
        },
        "product_reference": "perl-YAML-Syck-0:1.30-7.el8_10.src",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-YAML-Syck-0:1.30-7.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.x86_64"
        },
        "product_reference": "perl-YAML-Syck-0:1.30-7.el8_10.x86_64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.aarch64"
        },
        "product_reference": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.aarch64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.ppc64le"
        },
        "product_reference": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.ppc64le",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.s390x"
        },
        "product_reference": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.s390x",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.x86_64"
        },
        "product_reference": "perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.x86_64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.aarch64"
        },
        "product_reference": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.aarch64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.ppc64le"
        },
        "product_reference": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.ppc64le",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.s390x"
        },
        "product_reference": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.s390x",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.x86_64"
        },
        "product_reference": "perl-YAML-Syck-debugsource-0:1.30-7.el8_10.x86_64",
        "relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13713",
      "cwe": {
        "id": "CWE-1341",
        "name": "Multiple Releases of Same Resource or Handle"
      },
      "discovery_date": "2026-07-16T22:01:11.855066+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2501564"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in YAML::Syck. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted YAML document. The flaw occurs due to a use-after-free and double-free condition when an anchor node is redefined while still on the parser\u0027s value stack, leading to the interpreter crashing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in `perl-YAML-Syck` can lead to a denial of service when processing untrusted YAML documents. The flaw, a use-after-free and double-free, causes the interpreter to crash if a specially crafted YAML document redefines an anchor during parsing. This poses a risk to Red Hat systems that handle external YAML input without sufficient validation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.aarch64",
          "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.ppc64le",
          "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.s390x",
          "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.src",
          "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.x86_64",
          "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.aarch64",
          "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.ppc64le",
          "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.s390x",
          "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.x86_64",
          "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.aarch64",
          "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.ppc64le",
          "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.s390x",
          "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13713"
        },
        {
          "category": "external",
          "summary": "RHBZ#2501564",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501564"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13713",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13713"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13713",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13713"
        },
        {
          "category": "external",
          "summary": "https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch",
          "url": "https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch"
        },
        {
          "category": "external",
          "summary": "https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes",
          "url": "https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes"
        }
      ],
      "release_date": "2026-07-16T21:35:31.477000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-14T09:06:14+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.src",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67269"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.src",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.src",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-0:1.30-7.el8_10.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debuginfo-0:1.30-7.el8_10.x86_64",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.aarch64",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.ppc64le",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.s390x",
            "CRB-8.10.0.Z.MAIN.EUS:perl-YAML-Syck-debugsource-0:1.30-7.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document"
    }
  ]
}

CVE-2026-13713 (GCVE-0-2026-13713)

Vulnerability from cvelistv5 – Published: 2026-07-16 21:35 – Updated: 2026-07-17 13:18

Title

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack

Summary

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-17 13:17 UTC

CWE

CWE-416 - Use After Free
CWE-415 - Double Free

Assigner

CPANSec redhat root Scorecard

References

3 references

URL	Tags
https://metacpan.org/release/TODDR/YAML-Syck-1.47…	release-notes
https://github.com/toddr/YAML-Syck/commit/44c90a1…	patch
http://www.openwall.com/lists/oss-security/2026/07/17/1

Impacted products

1 product

Vendor	Product	Version
TODDR	YAML::Syck	Affected: 0 , < 1.47 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-17T03:02:25.421Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/17/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-13713",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T13:17:36.382946Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T13:18:02.930Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "YAML-Syck",
          "product": "YAML::Syck",
          "programFiles": [
            "handler.c",
            "syck_.c",
            "syck.h"
          ],
          "programRoutines": [
            {
              "name": "syck_hdlr_add_anchor"
            },
            {
              "name": "syck_hdlr_remove_anchor"
            },
            {
              "name": "syck_hdlr_add_node"
            }
          ],
          "repo": "https://github.com/toddr/YAML-Syck",
          "vendor": "TODDR",
          "versions": [
            {
              "lessThan": "1.47",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.\n\nIn the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser\u0027s value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.\n\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-415",
              "description": "CWE-415 Double Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-16T21:35:31.477Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to YAML-Syck 1.47 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-13713",
    "datePublished": "2026-07-16T21:35:31.477Z",
    "dateReserved": "2026-06-29T13:57:19.498Z",
    "dateUpdated": "2026-07-17T13:18:02.930Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:67269

CVE-2026-13713 (GCVE-0-2026-13713)

Tags

Sightings

Nomenclature

Related by attack behaviour