Your message dated Sat, 26 Sep 2026 10:05:21 -0500
with message-id <[email protected]>
and subject line Re: Bug#1149048: yaml-cpp: CVE-2026-75432
has caused the Debian Bug report #1149048,
regarding yaml-cpp: CVE-2026-75432
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149048: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149048
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: yaml-cpp
Version: 0.9.0+dfsg-9
Severity: important
Tags: security upstream
Forwarded: https://github.com/jbeder/yaml-cpp/issues/1475
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for yaml-cpp.
CVE-2026-75432[0]:
| An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain
| sensitive information via the src/scanner.cpp, Scanner::PopIndent(),
| and Scanner::PushIndentTo() components
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-75432
https://www.cve.org/CVERecord?id=CVE-2026-75432
[1] https://github.com/jbeder/yaml-cpp/issues/1475
[2] https://github.com/jbeder/yaml-cpp/pull/1476
[3]
https://github.com/jbeder/yaml-cpp/commit/8b2e6ba3288de15ed7a61d5c89cde2ed47327c1e
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Control: notfound -1 0.9.0+dfsg-9
Hi Salvatore,
Please mark yaml-cpp <not-affected> for bookworm, trixie, and sid. No upload is
planned.
The crash is an empty indent-stack pop in Scanner::PopIndent(). Upstream
introduced it in c7a86c0 (PR #1468, 2026-07-30), *after* the yaml-cpp-0.9.0 tag
(56e3bb5, 2026-02-04). That commit is not in the 0.9.0 tarball.
I ran the public inputs against the archive versions:
bookworm 0.7.0+dfsg-8+b1 ParserException (the 96-byte sample parses)
trixie 0.8.0+dfsg-7 ParserException
sid 0.9.0+dfsg-9 ParserException
None of them abort. Those inputs do abort on upstream 3eb39d5, which is after
#1468 and before #1476: UndefinedBehaviorSanitizer in PopIndent(), and SIGSEGV.
The MITRE text describes an information leak in 0.9.0. What reproduces is a
crash on master snapshots from 30 July to 10 August 2026. No Debian suite is in
that window.
Please let me know if you have any questions, or if this still needs to be
fixed after all.
Best regards,
Simon Quigley
[email protected]
OpenPGP_signature.asc
Description: OpenPGP digital signature
--- End Message ---
