Loading story…
YAML::Syck version 1.47 has been released to fix multiple memory-safety vulnerabilities in the Perl module’s bundled libsyck library, all reachable through the default Load or LoadFile parsing path when handling untrusted YAML. The disclosed issues include CVE-2026-57075, an out-of-bounds read in syck_base64dec caused by indexing a 256-entry lookup table with a signed char; CVE-2026-57076, a heap use-after-free in syck_hdlr_add_anchor when an anchor name is reused as an anchors-table key; and CVE-2026-57077, an out-of-bounds read in newline_len during block-scalar lexing at a document boundary. Advisories say affected versions are those before 1.47, and note that CVE-2026-57077 is an incomplete-fix follow-on to CVE-2025-11683.
Project maintainers also patched CVE-2026-13713, described in the code and release notes as a use-after-free/double-free involving anchor nodes that can cause a remote crash denial of service. The remediation adds targeted code fixes, changes anchor-table key ownership, introduces deferred cleanup for retired parser nodes, adds regression tests for each CVE, and expands AddressSanitizer-based CI to reproduce the vulnerable behavior and verify the fixes. The 1.47 release further hardens syck_base64dec() with bounds checks and sets a default Load maximum depth of 512 to reduce the risk of C-stack exhaustion from deeply nested YAML or JSON input.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-17, separate oss-sec advisories disclosed CVE-2026-57075, CVE-2026-57076, and CVE-2026-57077 affecting YAML::Syck versions before 1.47. The advisories described an out-of-bounds read in syck_base64dec, a heap use-after-free in anchor handling, and an out-of-bounds read in newline_len, and recommended upgrading to 1.47 or later.
On 2026-07-13, YAML::Syck version 1.47 was released to fix four memory-safety flaws in bundled libsyck code: CVE-2026-57075, CVE-2026-57076, CVE-2026-57077, and CVE-2026-13713. The release also added hardening and regression coverage, including AddressSanitizer-based CI checks and a default Load max depth of 512.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcegithub.com
Open sourcemetacpan.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A security advisory disclosed **CVE-2026-13713** in **YAML::Syck** for Perl, affecting versions before **1.47**. The flaw stems from bundled `libsyck` handling of anchor nodes that can be freed while still referenced on the parser value stack, creating both **use-after-free** and **double-free** conditions during YAML parsing. A specially crafted YAML document that redefines an anchor while being parsed can crash the Perl interpreter through the default `Load` path, causing **denial of service**. Applications that process untrusted YAML with `Load` or `LoadFile` are exposed, and the project’s GitHub repository reflects the maintained codebase for **YAML::Syck** and **JSON::Syck**; users are advised to upgrade to **YAML::Syck 1.47 or later**.
Jul 17, 2026
The CPAN Security Group disclosed two memory-safety vulnerabilities affecting widely used Perl modules. **CVE-2026-7040** impacts `Text::Minify::XS` from `v0.3.0` before `v0.7.8`, where malformed UTF-8 input can trigger a heap overflow in the `minify` and `minify_utf8` functions, leading to heap corruption through improper Unicode handling. Maintainers advised users to upgrade to `v0.7.8` or later, and said deployments that cannot patch immediately should validate strings before passing them to the affected routines. A separate advisory, **CVE-2026-7111**, affects `Text::CSV_XS` before `1.62` and stems from a use-after-free when registered callbacks extend the Perl argument stack. The bug arises because methods including `Parse`, `print`, `getline`, and `getline_all` may retain a stale stack pointer across callback execution, creating a path to type confusion, memory corruption, crashes, or logic errors. The issue does not affect `Text::CSV_XS` instances that do not use registered callbacks, and the fix was released in version `1.62` after a public patch and CPAN publication.
Jun 29, 2026
Multiple vulnerabilities in the Rust serialization crate **rkyv** allow crafted untrusted archives to bypass validation in supposedly safe checked deserialization paths and trigger memory safety failures. RustSec advisories `RUSTSEC-2026-0233`, `RUSTSEC-2026-0234`, and `RUSTSEC-2026-0235` describe flaws that can lead to a heap use-after-free in `ArchivedString::deserialize`, out-of-bounds reads in archives containing hash tables, and out-of-bounds reads involving `Rc`/`Arc` shared pointers. Affected safe APIs include `rkyv::access` and `rkyv::from_bytes`, and the resulting impact includes process crashes, denial of service, and potential memory exposure when applications process attacker-controlled archive bytes. The issues were fixed in **rkyv 0.8.17**, which strengthens archive range validation, rejects malformed relative pointers and inconsistent hash table states, and hardens shared-pointer verification. An upstream code change shows the project now validates shared pointers using both erased data pointers and pointer metadata, explicitly detecting conflicting metadata such as forged slice lengths that reference the same memory region. The maintainers said the `0.7` series is also affected but unsupported, and advised users handling untrusted archives to upgrade to `0.8.17` or later.
Aug 4, 2026