Description
YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.
The heap overflow occurs when class names exceed the initial 512-byte allocation.
The base64 decoder could read past the buffer end on trailing newlines.
strtok mutated n->type_id in place, corrupting shared node data.
A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TODDR | YAML::Syck | ≤ 1.36 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libyaml-syck-perl | 1.36-2 | — |
| Debian 13 | libyaml-syck-perl | 1.34-2+deb13u2 | DSA-6175-1 |
| Debian 12 | libyaml-syck-perl | 1.34-2+deb12u2 | DSA-6175-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libyaml-syck-perl | No fix yet | — |
| Ubuntu 26.04 LTS | libyaml-syck-perl | No fix yet | — |
| Ubuntu 25.10 | libyaml-syck-perl | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | libyaml-syck-perl | No fix yet | — |
| Ubuntu Pro 22.04 LTS | libyaml-syck-perl | No fix yet | — |
| Ubuntu Pro 20.04 LTS | libyaml-syck-perl | No fix yet | — |
| Ubuntu Pro 18.04 LTS | libyaml-syck-perl | No fix yet | — |
| Ubuntu Pro 16.04 LTS | libyaml-syck-perl | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | perl-YAML-Syck | 1.30-6.el8_10 | RHSA-2026:6470 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 ELS | perl-YAML-Syck | 1.27-3.el7_9.1 | RHSA-2026:8311 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | perl-YAML-Syck | 1.30-6.el8_10 | ALSA-2026:6470 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | perl-YAML-Syck | 1.30-6.el8_10 | RLSA-2026:6470 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | perl-YAML-Syck | 1.440.0-1.1 | openSUSE-SU-2026:10551-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | perl-yaml-syck | 1.45-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | perl-YAML-Syck +1 | 1.37-1.amzn2023.0.1 | ALAS2023-2026-1517 |
| Amazon Linux 2 | perl-YAML-Syck | 1.27-3.amzn2.0.4 | ALAS2-2026-3216 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | perl-YAML +1 | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | perl-YAML-Syck | 1.30-6.el8_10 | ELSA-2026-6470 |
Advisories 10
- ALSA-2026:6470 Important: perl-YAML-Syck security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-0939 cPanel cPanel/WHM (perl-YAML-Syck): Schwachstelle ermöglicht Codeausführung und DoS BSI CERT-Bund (WID) · Jul 27, 2026
- RHSA-2026:8311 Red Hat Security Advisory: perl-YAML-Syck security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2026:6470 Red Hat Security Advisory: perl-YAML-Syck security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- openSUSE-SU-2026:10551-1 perl-YAML-Syck-1.440.0-1.1 on GA media SUSE / openSUSE Security Updates · Apr 16, 2026
- RLSA-2026:6470 Important: perl-YAML-Syck security update Rocky Linux Security Advisories · Apr 9, 2026
- ELSA-2026-6470 Important: perl-YAML-Syck security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 3, 2026
- ALAS2023-2026-1517 Important: perl-YAML-Syck security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 1, 2026
- ALAS2-2026-3216 Important: perl-YAML-Syck security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 1, 2026
- DSA-6175-1 libyaml-syck-perl - security update Debian Security (DSA / DLA) · Mar 22, 2026