CVE-2026-57076

A flaw was found in YAML::Syck. An attacker could exploit a heap use-after-free vulnerability by providing a specially crafted YAML document that reuses an anchor name as an anchors-table key. This flaw causes the software to read freed heap memory, which may lead to information disclosure or denial of service.

This Important heap use-after-free vulnerability in perl-YAML-Syck can be triggered by processing a specially crafted YAML document. The flaw, exploitable through the default YAML loading mechanism, may lead to information disclosure or a denial of service in applications handling untrusted YAML input.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce the risk associated with this vulnerability, avoid processing untrusted YAML documents with applications that use perl-YAML-Syck. Restricting the source of YAML input to trusted origins is an operational control that can limit exposure.