CVE-2026-88359 Details
Description
libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a very large literal or folded block scalar, the function repeatedly grows an internal buffer using alloca() inside a loop. The allocated stack memory is not released until the function returns, causing cumulative stack growth that can exceed the process stack limit and result in SIGSEGV and denial of service.
A stack exhaustion vulnerability has been identified in libfyaml version 0.9.6. The issue arises in the function fy_atom_iter_format(), which handles YAML block scalars. When the function processes a specially crafted YAML document with a large literal or folded block scalar, it accumulates stack memory by repeatedly growing an internal buffer with alloca() inside a loop. This unbounded stack growth can exceed the process's stack limit, leading to a segmentation fault (SIGSEGV) and causing a denial-of-service condition. The vulnerability can be triggered remotely and without authentication.
Users can upgrade to libfyaml version 0.9.7 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pantoniou/libfyaml/issues/315 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/pantoniou/libfyaml/commit/20502068902d58c076da873117985798df2c7e74 | [email protected] | Source CodeVendor |
| https://github.com/pantoniou/libfyaml/commit/93741a7c9331da9da65ef7a25f2d7d6a817a1c29 | [email protected] | Source CodeVendor |
| https://github.com/pantoniou/libfyaml/issues/315 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| libfyaml | 0.9.6 (semver) 1.0.0-alpha8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |