CVE-2026-4177

CRITICAL EPSS 39.0%
Published Mar 16, 20263mo ago · Modified Jun 17, 20262w ago
9.1 CVSS 3.1
Critical
Find Similar
Published Mar 16, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. The heap overflow occurs when class names exceed the initial 512-byte allocation. The base64 decoder could read past the buffer end on trailing newlines. strtok mutated n->type_id in place, corrupting shared node data. A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.

CVSS Details

Base Score
9.1
Exploitability
3.9
Impact
5.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
39.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-122

Affected Products 1

VendorProductVersionRange
toddryaml\\ <1.37

References 3

  • openwall.com http://www.openwall.com/lists/oss-security/2026/03/16/6
    Mailing ListThird Party Advisory
  • github.com https://github.com/cpan-authors/YAML-Syck/commit/e8844a31c8cf0052914b198fc784ed4e6b8ae69e.patch
    Patch
  • metacpan.org https://metacpan.org/release/TODDR/YAML-Syck-1.37_01/changes#L21
    Release Notes

Remediation

  • github.com https://github.com/cpan-authors/YAML-Syck/commit/e8844a31c8cf0052914b198fc784ed4e6b8ae69e.patch
    Patch