Junglewise Threat Intelligence

CVE-2026-5089: YAML::Syck out-of-bounds read in base60 parsing

CVE-2026-5089 · Severity: info · CVSS 0 · Published 2026-05-12

Technologies: CPAN YAML-Syck. Vendors: CPAN.

Executive brief

YAML::Syck is a Perl library used for parsing and emitting YAML and JSON data. A vulnerability in how it handles specific time-based or base-60 (sexagesimal) numbers could allow a specially crafted YAML document to cause the application to read memory outside of its intended boundaries. This could lead to application crashes or potential data corruption in environments where these values are processed.

Technical details

An out-of-bounds read (specifically a buffer underwrite/underflow) exists in perl_syck.h within the int#base60 and float#base60 handlers. When the parser processes the leftmost segment of a colon-separated base-60 value (e.g., '1' in '1:30:45'), a while loop decrements a pointer without sufficient bounds checking. If no colon is found in the final segment, the pointer is decremented to one byte before the start of the string buffer (ptr - 1). Subsequent dereferencing of this pointer results in an out-of-bounds read. This can cause undefined behavior, application crashes under memory sanitizers like ASan, or data corruption if the preceding byte is interpreted as a delimiter. The issue is fixed in version 1.38 by ensuring the pointer does not decrement past the buffer start.

Affected products

  • CPAN/YAML-Syck authors YAML::Syck before 1.38

Timeline

  • 2026-03-20: patched: Fix committed to repository
  • 2026-03-20: other: Version 1.38 released on CPAN
  • 2026-05-12: advisory: CVE-2026-5089 disclosed via NVD and mailing lists

References