https://bugzilla.redhat.com/show_bug.cgi?id=2501654
Bug ID: 2501654
Summary: CVE-2026-57076 perl-YAML-Syck: YAML::Syck: Heap
use-after-free via anchor name reuse [fedora-all]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["246724d5-b8da-4347-b2f7-76bb95fbe3f9"]}
Component: perl-YAML-Syck
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected],
[email protected]
Blocks: 2501583
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an
anchor name reused as an anchors-table key in syck_hdlr_add_anchor.
In the bundled libsyck an anchor name allocated by syck_strndup is stored both
as node->anchor, freed when the node is freed, and as the key in the parser's
anchors table. Freeing the node frees the shared key, and a later anchor
redefinition makes st_delete compare against the freed key, so st_strcmp reads
freed heap memory. Anchors are a standard YAML feature and need no special
flags, so this is reached on the default Load path.
Any caller that runs Load or LoadFile on an untrusted document that redefines
an anchor reaches the read of freed memory.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2501654
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202501654%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
