CVE-2026-4177

Description

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.The heap overflow occurs when class names exceed the initial 512-byte allocation.The base64 decoder could read past the buffer end on trailing newlines.strtok mutated n->type_id in place, corrupting shared node data.A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string a was leaked on early return.

Risk Information

Associated Vulnerability

Patch Details

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234