Loading story…
A security advisory disclosed CVE-2026-13713 in YAML::Syck for Perl, affecting versions before 1.47. The flaw stems from bundled libsyck handling of anchor nodes that can be freed while still referenced on the parser value stack, creating both use-after-free and double-free conditions during YAML parsing.
A specially crafted YAML document that redefines an anchor while being parsed can crash the Perl interpreter through the default Load path, causing denial of service. Applications that process untrusted YAML with Load or LoadFile are exposed, and the project’s GitHub repository reflects the maintained codebase for YAML::Syck and JSON::Syck; users are advised to upgrade to YAML::Syck 1.47 or later.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
An oss-sec advisory disclosed CVE-2026-13713 affecting YAML::Syck versions before 1.47 for Perl. The flaw in bundled libsyck can cause use-after-free and double-free conditions via crafted YAML input, potentially crashing the Perl interpreter and exposing applications that parse untrusted YAML with Load or LoadFile.
The GitHub repository indicates YAML::Syck version 1.47 was published, which is the fixed version referenced by the later advisory for CVE-2026-13713.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
YAML::Syck version **1.47** has been released to fix multiple memory-safety vulnerabilities in the Perl module’s bundled `libsyck` library, all reachable through the default `Load` or `LoadFile` parsing path when handling untrusted YAML. The disclosed issues include **CVE-2026-57075**, an out-of-bounds read in `syck_base64dec` caused by indexing a 256-entry lookup table with a signed `char`; **CVE-2026-57076**, a heap use-after-free in `syck_hdlr_add_anchor` when an anchor name is reused as an anchors-table key; and **CVE-2026-57077**, an out-of-bounds read in `newline_len` during block-scalar lexing at a document boundary. Advisories say affected versions are those before **1.47**, and note that CVE-2026-57077 is an incomplete-fix follow-on to **CVE-2025-11683**. Project maintainers also patched **CVE-2026-13713**, described in the code and release notes as a use-after-free/double-free involving anchor nodes that can cause a remote crash denial of service. The remediation adds targeted code fixes, changes anchor-table key ownership, introduces deferred cleanup for retired parser nodes, adds regression tests for each CVE, and expands AddressSanitizer-based CI to reproduce the vulnerable behavior and verify the fixes. The 1.47 release further hardens `syck_base64dec()` with bounds checks and sets a default `Load` maximum depth of **512** to reduce the risk of C-stack exhaustion from deeply nested YAML or JSON input.
Jul 17, 2026
A high-severity denial-of-service flaw tracked as **`CVE-2026-71847`** was disclosed in the Ruby `json` package, affecting versions **`2.20.0` through before `2.21.2`**. The bug resides in the native C extension behind **`JSON::ResumableParser`**, where truncated streaming JSON containing duplicate object keys can cause the parser to clear its input buffer while leaving stale internal pointers behind, creating a **heap-use-after-free** condition classified as **`CWE-416`**. If an application accepts attacker-controlled JSON streams and later calls **`partial_value`** on the incomplete input, the parser can perform pointer operations on freed memory in its warning-handling path and crash the Ruby worker process. The issue impacts availability rather than confidentiality or integrity, and the fix in **`json` `2.21.2`** clears the freed buffer, nullifies parser state pointers, and adjusts warning generation logic to avoid cursor calculations when parser state is still present.
Aug 8, 2026
The CPAN Security Group disclosed two memory-safety vulnerabilities affecting widely used Perl modules. **CVE-2026-7040** impacts `Text::Minify::XS` from `v0.3.0` before `v0.7.8`, where malformed UTF-8 input can trigger a heap overflow in the `minify` and `minify_utf8` functions, leading to heap corruption through improper Unicode handling. Maintainers advised users to upgrade to `v0.7.8` or later, and said deployments that cannot patch immediately should validate strings before passing them to the affected routines. A separate advisory, **CVE-2026-7111**, affects `Text::CSV_XS` before `1.62` and stems from a use-after-free when registered callbacks extend the Perl argument stack. The bug arises because methods including `Parse`, `print`, `getline`, and `getline_all` may retain a stale stack pointer across callback execution, creating a path to type confusion, memory corruption, crashes, or logic errors. The issue does not affect `Text::CSV_XS` instances that do not use registered callbacks, and the fix was released in version `1.62` after a public patch and CPAN publication.
Jun 29, 2026