Vulnerability · Published Mar 16, 2026 · Assigned by CPANSec
CVE-2026-4177YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter
Critical 9.1
In plain English
A critical-severity heap buffer overflow in YAML::Syck from TODDR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. The heap overflow occurs when class names exceed the initial 512-byte allocation. The base64 decoder could read past the buffer end on trailing newlines. strtok mutated n->type_id in place, corrupting shared node data. A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | perl-YAML-Syck | 1.30-6.el8_10 | ALSA-2026:6470 |
| Alpine:v3.24 | perl-yaml-syck | 1.45-r0 | ALPINE-CVE-2026-4177 |
| Debian:12 | libyaml-syck-perl | 1.34-2+deb12u2 | DSA-6175-1 |
| Debian:12 | libyaml-syck-perl | 1.34-2+deb12u2 | DEBIAN-CVE-2026-4177 |
| Debian:13 | libyaml-syck-perl | 1.34-2+deb13u2 | DSA-6175-1 |
| Debian:13 | libyaml-syck-perl | 1.34-2+deb13u2 | DEBIAN-CVE-2026-4177 |
| Debian:14 | libyaml-syck-perl | 1.36-2 | DEBIAN-CVE-2026-4177 |
| Rocky Linux:8 | perl-YAML-Syck | 0:1.30-6.el8_10 | RLSA-2026:6470 |
| Ubuntu:25.10 | libyaml-syck-perl | no fix listed | UBUNTU-CVE-2026-4177 |
| Ubuntu:26.04:LTS | libyaml-syck-perl | no fix listed | UBUNTU-CVE-2026-4177 |
| Ubuntu:26.10 | libyaml-syck-perl | no fix listed | UBUNTU-CVE-2026-4177 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TODDR | YAML::Syck | 0 – through 1.36 |
Weakness: CWE-122, CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
References
- https://github.com/cpan-authors/YAML-Syck/commit/e8844a31c8cf0052914b198fc784ed4e6b8ae69e.patch patch
- https://metacpan.org/release/TODDR/YAML-Syck-1.37_01/changes#L21 release-notes
- http://www.openwall.com/lists/oss-security/2026/03/16/6
- https://access.redhat.com/security/cve/CVE-2026-4177 vdb-entry, x_refsource_REDHAT
- RHBZ#2448277 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4177.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:8311 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6470 vendor-advisory, x_refsource_REDHAT