CVE-2026-5089: YAML::Syck out-of-bounds read in base60 parsing

CVE-2026-5089 · Severity: info · CVSS 0 · Published 2026-05-12

YAML::Syck is a Perl library used for parsing and emitting YAML and JSON data. A vulnerability in how it handles specific time-based or base-60 (sexagesimal) numbers could allow a specially crafted YAML document to cause the application to read memory outside of its intended boundaries. This could lead to application crashes or potential data corruption in environments where these values are processed.

Technologies: CPAN YAML-Syck. Vendors: CPAN.

Quick answers

Is CVE-2026-5089 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-5089 being exploited in the wild.
How severe is CVE-2026-5089?
Informational severity, with a CVSS score of 0, published 12 May 2026.
Which products and versions are affected?
CPAN YAML-Syck before 1.38.
Is there a fix for CVE-2026-5089?
A patch was published on 2026-03-20: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5089 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-5089?
Check whether you run CPAN YAML-Syck at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read (specifically a buffer underwrite/underflow) exists in perl_syck.h within the int#base60 and float#base60 handlers. When the parser processes the leftmost segment of a colon-separated base-60 value (e.g., '1' in '1:30:45'), a while loop decrements a pointer without sufficient bounds checking. If no colon is found in the final segment, the pointer is decremented to one byte before the start of the string buffer (ptr - 1). Subsequent dereferencing of this pointer results in an out-of-bounds read. This can cause undefined behavior, application crashes under memory sanitizers like ASan, or data corruption if the preceding byte is interpreted as a delimiter. The issue is fixed in version 1.38 by ensuring the pointer does not decrement past the buffer start.

Affected products

  • CPAN/YAML-Syck authors YAML::Syck before 1.38

Timeline

  • 2026-03-20: patched: Fix committed to repository
  • 2026-03-20: other: Version 1.38 released on CPAN
  • 2026-05-12: advisory: CVE-2026-5089 disclosed via NVD and mailing lists

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.