CVE-2025-11683

An out of bounds read flaw has been discovered in the Perl YAML::Syck package. Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variables to be read. The issue is seen with complex YAML files with a hash of all keys and empty values.  There is no indication that the issue leads to accessing memory outside that allocated to the module.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.