CVE-2026-4177 Details
Description
YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. The heap overflow occurs when class names exceed the initial 512-byte allocation. The base64 decoder could read past the buffer end on trailing newlines. strtok mutated n->type_id in place, corrupting shared node data. A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.
A heap buffer overflow vulnerability has been identified in YAML::Syck for Perl, affecting versions through 1.36. This vulnerability arises in the YAML emitter when class names exceed the initial 512-byte allocation, leading to a heap overflow. Additionally, the base64 decoder could read past the buffer's end due to trailing newlines, and strtok improperly mutated node type identifiers, corrupting shared node data. A memory leak was also present in the anchor handling function when a node already had an anchor, causing the incoming anchor string to be leaked on early return.
Users are advised to update to YAML::Syck version 1.37 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:6470 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:8311 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-4177 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2448277 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4177.json | redhat-SADP | |
| https://github.com/cpan-authors/YAML-Syck/commit/e8844a31c8cf0052914b198fc784ed4e6b8ae69e.patch | CPANSec | Patch |
| https://metacpan.org/release/TODDR/YAML-Syck-1.37_01/changes#L21 | CPANSec | Release Notes |
| http://www.openwall.com/lists/oss-security/2026/03/16/6 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | redhat-SADP |
| CWE-122 | Heap-based Buffer Overflow | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| toddr yaml::syck | < 1.37 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 17, 2026 | CVE Modified | CISA-ADP |
| Mar 17, 2026 | CVE Modified | CVE |
| Mar 16, 2026 | New CVE Received | CPANSec |