CVE-2026-5089 Details
Description
YAML::Syck versions before 1.38 for Perl has an out-of-bounds read. The base60 (sexagesimal) parsing code in perl_syck.h has a buffer underflow bug in both int#base60 and float#base60 handlers. When processing the leftmost segment of a colon-separated value (e.g., the 1 in 1:30:45), the inner while loop can decrement a pointer past the start of the string buffer: while ( colon >= ptr && *colon != ':' ) { colon--; } if ( *colon == ':' ) *colon = '\0'; // colon may be ptr-1 here When no colon is found (final/leftmost segment), colon becomes ptr-1, and the subsequent *colon dereference reads one byte before the allocated buffer.
A buffer underflow vulnerability has been identified in YAML::Syck versions prior to 1.38 for Perl. The issue arises in the base60 parsing code within perl_syck.h, specifically in the int#base60 and float#base60 handlers. When the parser processes the leftmost segment of a colon-separated value, the inner loop can decrement a pointer past the beginning of the string buffer. This out-of-bounds read creates undefined behavior, potentially leading to data corruption or a crash when the library is used with AddressSanitizer or Valgrind. The vulnerability is triggered when YAML documents contain sexagesimal values and the ImplicitTyping feature is enabled.
Users should upgrade to YAML::Syck version 1.38 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 12, 2026CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cpan-authors/YAML-Syck/issues/132 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/cpan-authors/YAML-Syck/commit/208a4d3bd1b5cdb4a791a6e3905bd6bd45e9d005.patch | CPANSec | Source CodeVendor |
| https://github.com/cpan-authors/YAML-Syck/issues/132 | CPANSec | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/cpan-authors/YAML-Syck/pull/133 | CPANSec | Source CodeVendor |
| https://metacpan.org/release/TODDR/YAML-Syck-1.38/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/05/12/16 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-124 | Buffer Underwrite ('Buffer Underflow') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| YAML::Syck | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | CVE Modified | CVE |
| May 12, 2026 | New CVE Received | CPANSec |