https://bugzilla.redhat.com/show_bug.cgi?id=2501657
Bug ID: 2501657
Summary: CVE-2026-13713 perl-YAML-Syck: YAML::Syck: Denial of
Service via crafted YAML document [epel-all]
Product: Fedora EPEL
Version: epel10
Status: NEW
Whiteboard: {"flaws": ["b792cab2-16ee-4c9c-aba6-417aa7be4387"]}
Component: perl-YAML-Syck
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected],
[email protected]
Blocks: 2501564
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free
via an anchor node freed while still on the parser value stack.
In the bundled libsyck, when an anchor name is redefined or removed,
syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under
that name with syck_free_node. That node can still be live on the parser's
value stack, so syck_hdlr_add_node reaches it again and frees it a second time.
On a normal build the 48-byte node chunk is freed twice and the interpreter
aborts. Anchors need no special flags, so this is reached on the default Load
path, and a 7-byte document that redefines an anchor triggers it.
Any caller that runs Load or LoadFile on an untrusted document that redefines
an anchor mid-parse crashes the interpreter, a denial of service.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2501657
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202501657%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
