Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 439
Alerts This Week
Warning Icon 1 439

Fedora 43 perl-YAML-Syck Critical Denial of Service Update 2026-c8484f1afb

fedora
Calendar Grey July 22, 2026
Scroller Fedora
This update for Perl-YAML-Syck on Fedora addresses critical memory-safety issues including CVE-2026-57075 and more.
The Fedora update for perl-YAML-Syck addresses four memory-safety vulnerabilities, enhancing security and fixing additional bugs while providing compatibility improvements.

Summary

This module provides a Perl interface to the libsyck data serialization

library. It exports the Dump and Load functions for converting Perl data

structures to YAML strings, and the other way around.

Update Information:

This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags: CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared between the node and the anchors table CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683) CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input There are also a few other bug-fixes included.

Topics%20covered

Topics Covered

security advisory denial of service fedora critical software update memory safety

Change Log

* Tue Jul 14 2026 Paul Howarth - 1.47-1 - Update to 1.47 Security: - Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags (GH#213) - CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input - CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared between the node and the anchors table - CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683) - CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input - Harden syck_base64dec() to bounds-check each read so it cannot run past a non-NUL-terminated input buffer (defense-in-depth for callers passing raw buffers; GH#213) Bug Fixes: - Fix: Enforce $MaxDepth on Load to prevent C-stack exhaustion from deeply nested YAML/JSON input; YAML::Syck and JSON::Syck Load now default to 512, matching Dump (GH#204) - Fix: Emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values in Dump so they roundtrip with ImplicitTyping instead of reloading as plain strings (GH#201) Maintenance: - CI: add an AddressSanitizer job that builds the XS with -fsanitize=address and runs the suite plus the CVE trigger inputs to catch libsyck memory-safety defects; de-pin the libasan version so it tracks the runner's GCC (GH#213) * Mon May 25 2026 Paul Howarth - 1.46-1 - Update to 1.46 Bug Fixes: - Preserve string nature of numeric-looking values in Dump; pure strings (POK only, no IOK/NOK) are now quoted to maintain roundtrip fidelity (GH#199, GH#200) - Accept trailing commas in flow sequences and mappings ([a, b,] and {a: 1,}), valid per YAML 1.0/1.1/1.2 spec (GH#195, GH#196) Maintenance: - CI: upgrade install-with-cpm to v2 for compatibility with Perl versions prior to 5.24 in perldocker containers (GH#197, GH#198) - Clean up MANIFEST.SKIP: add #!include_default, remove redundant entries, exclude .claude/ from distribution

References


[ 1 ] Bug #2501651 - CVE-2026-57075 perl-YAML-Syck: YAML::Syck: Information disclosure via out-of-bounds read in base64 decoder [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2501651 [ 2 ] Bug #2501653 - CVE-2026-57077 perl-YAML-Syck: YAML::Syck: Information disclosure via out-of-bounds read [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2501653 [ 3 ] Bug #2501654 - CVE-2026-57076 perl-YAML-Syck: YAML::Syck: Heap use-after-free via anchor name reuse [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2501654 [ 4 ] Bug #2501656 - CVE-2026-13713 perl-YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2501656

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-c8484f1afb' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: perl-YAML-Syck
Product: Fedora 43
Version: 1.47
Release: 1.fc43
URL: https://metacpan.org/release/YAML-Syck
Summary: Fast, lightweight YAML loader and dumper

Topics%20covered

Topics Covered

security advisory denial of service fedora critical software update memory safety

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.