https://bugzilla.redhat.com/show_bug.cgi?id=2501653
Bug ID: 2501653
Summary: CVE-2026-57077 perl-YAML-Syck: YAML::Syck: Information
disclosure via out-of-bounds read [fedora-all]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["80d0124a-60dd-486b-860f-e313d0cbc4b9"]}
Component: perl-YAML-Syck
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected],
[email protected]
Blocks: 2501576
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an
unbounded newline scan in newline_len.
In the bundled libsyck newline_len and is_newline dereference the scan pointer,
and the following byte for a "\r\n" pair, with no NUL-terminator or bounds
check. During block-scalar lexing at a document boundary the scan runs one byte
past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a
lexer path the earlier fix did not cover.
Any caller that runs Load or LoadFile on an untrusted document with a block
scalar at a document boundary reaches the over-read.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2501653
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202501653%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
