/ 
YAML-Syck-0.14
/ YAML::Syck
Security Advisories (2)
CVE-2025-11683 (2025-10-16)

YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read The issue is seen with complex YAML files with a hash of all keys and empty values. There is no indication that the issue leads to accessing memory outside that allocated to the module.

CVE-2026-4177 (2026-03-16)

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. The heap overflow occurs when class names exceed the initial 512-byte allocation. The base64 decoder could read past the buffer end on trailing newlines. strtok mutated n->type_id in place, corrupting shared node data. A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.

NAME

YAML::Syck - Fast, lightweight YAML loader and dumper

VERSION

This document describes version 0.14 of YAML::Syck, released January 9, 2005.

SYNOPSIS

use YAML::Syck;

$data = Load($yaml);
$yaml = Dump($data);

DESCRIPTION

This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around.

FLAGS

$YAML::Syck::ImplicitTyping

Defaults to false. Setting this to a true value will make Load recognize various implicit types in YAML, such as unquoted true, false, as well as integers and floating-point numbers. Otherwise, only ~ is recognized to be undef.

CAVEATS

The current implementation bundles libsyck source code; if your system has a side-wide shared libsyck, it will not be used.

This module is not currently pluggable to the new YAML (0.50+) framework, but that's expected to change in the future.

Dumping cyclic references is currently broken.

SEE ALSO

YAML

AUTHORS

Audrey Tang <autrijus@autrijus.org>

COPYRIGHT

Copyright by Audrey Tang <autrijus@autrijus.org>.

The libsyck code bundled with this library by why the lucky stiff, under a BSD-style license. See the COPYING file for details.

The Storable.xs code bundled with this library is written by Raphael Manfredi and maintained by perl5-porters, under the same license as Perl.

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

See http://www.perl.com/perl/misc/Artistic.html