Medium [CVE-2026-57077] YAML::Syck: YAML::Syck: Information disclosure via out-of-bounds read
This medium-severity Red Hat Linux advisory covers CVE-2026-57077 affecting Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check.
During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover.
Any caller that runs Load or LoadFile on an untrusted document with a block scalar at a document boundary reaches the over-read. An out-of-bounds read vulnerability exists due to an unbounded newline scan during block-scalar lexing.
A remote attacker could exploit this by providing a specially crafted YAML document, leading to potential information disclosure. This issue is an incomplete fix for a previously identified vulnerability.
Moderate: An out-of-bounds read flaw in `perl-YAML-Syck` can lead to information disclosure when processing specially crafted YAML documents. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8.
Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
- < 1.47
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Mitigation checklist
- To mitigate this vulnerability, restrict applications using `perl-YAML-Syck` from processing untrusted YAML documents. Ensure that only trusted input sources are parsed by `YAML::Syck`. If `perl-YAML-Syck` is not required, consider removing the package to eliminate the exposure, noting that this may affect dependent applications.
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.