CVE Explorer
CVE-2026-57077
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len.
In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover.
Any caller that runs Load or
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","packageName":"YAML-Syck","product":"YAML::Syck","programFiles":["token.c"],"programRoutines":[{"name":"newline_len"},{"name":"is_newline"}],"repo":"https://github.com/toddr/YAML-Syck","vendor":"TODDR","versions":[{"lessThan":"1.47","status":"affected","version":"0","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:156600af9ef11d888baff4898ac0cb238cd0182ebcaa29607bcec76f0724937a · sha256:a003dd5f813bdbbb… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:156600af9ef11d888baff4898ac0cb238cd0182ebcaa29607bcec76f0724937a · sha256:a003dd5f813bdbbb… · /containers/adp/0/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-125","description":"CWE-125 Out-of-bounds Read","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:156600af9ef11d888baff4898ac0cb238cd0182ebcaa29607bcec76f0724937a · sha256:a003dd5f813bdbbb… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"tags":["patch"],"url":"https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:156600af9ef11d888baff4898ac0cb238cd0182ebcaa29607bcec76f0724937a · sha256:a003dd5f813bdbbb… · /containers/cna/references/1
{"tags":["release-notes"],"url":"https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:156600af9ef11d888baff4898ac0cb238cd0182ebcaa29607bcec76f0724937a · sha256:a003dd5f813bdbbb… · /containers/cna/references/0
{"tags":["related"],"url":"https://www.cve.org/CVERecord?id=CVE-2025-11683"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:156600af9ef11d888baff4898ac0cb238cd0182ebcaa29607bcec76f0724937a · sha256:a003dd5f813bdbbb… · /containers/cna/references/2
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.