Skip to content
OpenAdvisories
Medium RHSA-2026:67269 1 CVE

Red Hat Security Advisory: perl-YAML-Syck security update

Published Sep 14, 2026 · Updated Sep 15, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::crb perl-YAML-Syck 0:1.30-7.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb perl-YAML-Syck-debuginfo 0:1.30-7.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb perl-YAML-Syck-debugsource 0:1.30-7.el8_10

Vulnerabilities 1

  • Medium 6.2
    CVE-2026-13713

    YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack

    YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anch…

    TODDR YAML::Syck libyaml-syck-perl perl-YAML-Syck Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2501564
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67269.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-13713
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-13713
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-13713
  • article
    https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch
  • article
    https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes