Skip to content
OpenAdvisories
High ALAS2-2025-3049 1 CVE

Important: perl-YAML-Syck security update (Amazon Linux 2)

Published Oct 27, 2025 · Updated Oct 27, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-11683: YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read The issue is seen with complex YAML files with a hash of all keys and empty values. There is no indication that the issue leads to accessing memory outside that allocated to the module.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 perl-YAML-Syck 0:1.27-3.amzn2.0.3
Amazon Linux · 2 perl-YAML-Syck-debuginfo 0:1.27-3.amzn2.0.3

Vulnerabilities 1

  • Medium 6.5
    CVE-2025-11683

    YAML::Syck versions before 1.36 for Perl has missing Null-Terminators which causes Out-of-Bounds Read and potential Information Disclosure

    YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read The issue is s…

    TODDR YAML::Syck perl-YAML-Syck perl-YAML Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-11683.html