Back Linuxsecurity

Fedora 42 perl-YAML-Syck High Buffer Overflow Advisory 2026

Linuxsecurity •LinuxSecurity Advisories • March 31, 2026

This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around. Update Information : YAML::Syck versions up to and including 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. The heap overflow occurs when class names exceed the initial 512-byte allocation. The base64 decoder could read past the buffer end on trailing newlines. strtok mutated n->type_id in place, corrupting shared node data. A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.

This module provides a Perl interface to the libsyck data serialization

library. It exports the Dump and Load functions for converting Perl data

structures to YAML strings, and the other way around.

YAML::Syck versions up to and including 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. The heap overflow occurs when class names exceed the initial 512-byte allocation. The base64 decoder could read past the buffer end on trailing newlines. strtok mutated n->type_id in place, corrupting shared node data. A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.

* Sun Mar 22 2026 Paul Howarth - 1.39-1 - Update to 1.39 Bug Fixes: - Fix: escape solidus (/) as \/ in JSON::Syck::Dump for XSS safety (GH#125, GH#130) - Fix: anchor tracking for blessed scalar refs in Dump (GH#126, GH#131) - Fix: prevent buffer underflow in base60 (sexagesimal) parsing (GH#133) - Fix: guard against NULL type from strtok in tag parsing (GH#135) - Fix: correct copy-paste bug in syck_seq_assign() ASSERT macros (GH#137) - Fix t/yaml-implicit-typing.t failure with -Duselongdouble perls (GH#138, GH#139) Improvements: - Resolve TODO tests for empty/invalid YAML to match actual behaviour (GH#127, GH#129) Maintenance: - Remove dead Perl 5.6 TODOs and convert 5.8 TODO to SKIP (GH#129) - Add comprehensive implicit type resolution test suite (GH#137) - Update MANIFEST to include all unit tests - Clean up test names to remove unnecessary numbering * Thu Mar 19 2026 Paul Howarth - 1.37-1 - Update to 1.37 Features: ...

[ 1 ] Bug #2448281 - CVE-2026-4177 perl-YAML-Syck: YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-d226775800' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora 42 and 43 perl-YAML-Syck Buffer Overflow Vulnerabilities Fedora versions 42 and 43 are affected by high-severity vulnerabilities in the perl-YAML-Syck module, specifically versions up to and including 1.36. These vulnerabilities include a heap buffer overflow in the YAML emitter, which can occur when class names exceed the initial 512-byte allocation. Additionally, the base64 decoder may read past the buffer end on trailing newlines, and a memory leak can occur in the syck_hdlr_add_anchor function. The vulnerabilities could lead to data corruption and potential exploitation. The CVE-2026-4177 was published on March 16, 2026, detailing these issues. Users are advised to update to version 1.39 or later to mitigate these risks. The updates include various bug fixes and improvements to enhance security and functionality. 2 sources 71

Extracted Entities

Companies (1)

Fedora

CVEs (1)

CVE-2026-4177