Executive brief
YAML::Syck is a software library used by Perl applications to process YAML data files. A vulnerability in how the library handles 'anchors' (a way to label data for reuse) allows a specially crafted 7-byte document to crash the application. This can be used by an attacker to cause a denial-of-service, potentially taking down web services or automated processing systems that handle untrusted YAML input.
Technical details
A use-after-free and double-free vulnerability exists in the bundled libsyck library within YAML::Syck before version 1.47. The root cause is located in syck_hdlr_add_anchor and syck_hdlr_remove_anchor, which free a SyckNode when an anchor is redefined or removed. However, if that node is still present on the parser's value stack, syck_hdlr_add_node may attempt to access and free it again. This leads to a C-level abort (SIGABRT) and interpreter crash. The vulnerability is reachable via the default Load and LoadFile paths without any special flags. A fix was introduced in version 1.47 by implementing a 'retired' table to defer node freeing until parser teardown.
Affected products
- TODDR YAML::Syck < 1.47
Timeline
- 2026-07-13: patched: Fix committed to repository
- 2026-07-16: advisory: NVD publication date