Skip to content
OpenAdvisories
Medium USN-7844-1 1 CVE

libyaml-syck-perl vulnerability

Published Oct 28, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that YAML::Syck did not properly handle parsing YAML
files. An attacker could possibly use this issue to expose sensitive
information.

Fixed packages 6

ReleasePackageFixed in
Ubuntu · 25.10 libyaml-syck-perl 1.34-3ubuntu0.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS libyaml-syck-perl 1.29-1ubuntu0.16.04.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS libyaml-syck-perl 1.29-1ubuntu0.18.04.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS libyaml-syck-perl 1.31-1ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS libyaml-syck-perl 1.34-1ubuntu0.1~esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS libyaml-syck-perl 1.34-2ubuntu0.24.04.1~esm1

Vulnerabilities 1

  • Medium 6.5
    CVE-2025-11683

    YAML::Syck versions before 1.36 for Perl has missing Null-Terminators which causes Out-of-Bounds Read and potential Information Disclosure

    YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read The issue is s…

    TODDR YAML::Syck perl-YAML-Syck perl-YAML Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2025-11683