Hi,

The following vulnerabilities were published for libyaml-syck-pel.

Sorry I'm filling one single bug covering multiple CVEs but in this
case there was as well just one commit covering all 4 CVEs, so it is
affordable to cover in one bug and not make further affected version
distinctions.

CVE-2026-57077[0]:
| YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read
| via an unbounded newline scan in newline_len.  In the bundled
| libsyck newline_len and is_newline dereference the scan pointer, and
| the following byte for a "\r\n" pair, with no NUL-terminator or
| bounds check. During block-scalar lexing at a document boundary the
| scan runs one byte past the heap lexer buffer. This is an incomplete
| fix of CVE-2025-11683, on a lexer path the earlier fix did not
| cover.  Any caller that runs Load or LoadFile on an untrusted
| document with a block scalar at a document boundary reaches the
| over-read.


CVE-2026-57076[1]:
| YAML::Syck versions before 1.47 for Perl allow a heap use-after-free
| via an anchor name reused as an anchors-table key in
| syck_hdlr_add_anchor.  In the bundled libsyck an anchor name
| allocated by syck_strndup is stored both as node->anchor, freed when
| the node is freed, and as the key in the parser's anchors table.
| Freeing the node frees the shared key, and a later anchor
| redefinition makes st_delete compare against the freed key, so
| st_strcmp reads freed heap memory. Anchors are a standard YAML
| feature and need no special flags, so this is reached on the default
| Load path.  Any caller that runs Load or LoadFile on an untrusted
| document that redefines an anchor reaches the read of freed memory.


CVE-2026-57075[2]:
| YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read
| via a signed-char lookup-table index in syck_base64dec.  The base64
| decoder in the bundled libsyck indexes the 256-entry static table
| b64_xtable with a signed char, so any !!binary byte >= 0x80 sign-
| extends to a negative index and reads before the table. The decoder
| receives the raw bytes of any !!binary node, a standard YAML type
| not gated by $LoadBlessed or $LoadCode, so it is reached on the
| default Load path.  Any caller that runs Load or LoadFile on an
| untrusted document containing a !!binary scalar with a high-bit byte
| triggers the read, and the value read can surface in the decoded
| result.


CVE-2026-13713[3]:
| YAML::Syck versions before 1.47 for Perl allow a use-after-free and
| double-free via an anchor node freed while still on the parser value
| stack.  In the bundled libsyck, when an anchor name is redefined or
| removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the
| node stored under that name with syck_free_node. That node can still
| be live on the parser's value stack, so syck_hdlr_add_node reaches
| it again and frees it a second time. On a normal build the 48-byte
| node chunk is freed twice and the interpreter aborts. Anchors need
| no special flags, so this is reached on the default Load path, and a
| 7-byte document that redefines an anchor triggers it.  Any caller
| that runs Load or LoadFile on an untrusted document that redefines
| an anchor mid-parse crashes the interpreter, a denial of service.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-57077
https://www.cve.org/CVERecord?id=CVE-2026-57077
[1] https://security-tracker.debian.org/tracker/CVE-2026-57076
https://www.cve.org/CVERecord?id=CVE-2026-57076
[2] https://security-tracker.debian.org/tracker/CVE-2026-57075
https://www.cve.org/CVERecord?id=CVE-2026-57075
[3] https://security-tracker.debian.org/tracker/CVE-2026-13713
https://www.cve.org/CVERecord?id=CVE-2026-13713
[4] https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libyaml-syck-perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142267@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated libyaml-syck-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 17 Jul 2026 14:57:10 +0200
Source: libyaml-syck-perl
Architecture: source
Version: 1.47-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1142267
Changes:
 libyaml-syck-perl (1.47-1) unstable; urgency=medium
 .
   * Import upstream version 1.47.
     - Fix four libsyck memory-safety CVEs reachable from the default
       YAML::Syck::Load() path on untrusted input with no special flags:
       CVE-2026-57077 CVE-2026-57076 CVE-2026-57075 CVE-2026-13713
     (Closes: #1142267)
   * Drop gcc15-fix.patch, fixed in 1.37 release.
   * Drop fix-address-all-4-C-layer-audit-findings-from-issue-.patch.
     Taken from upstream Git, fixed in 1.37.
   * Drop fix-prevent-buffer-underflow-in-base60-sexagesimal-p.patch.
     Taken from upstream Git, fixed in 1.45.
   * Declare compliance with Debian Policy 4.7.4.
   * Add debian/tests/pkg-perl/smoke-tests.
     Only run t/*.t during autopkgtests, as during build.
Checksums-Sha1:
 a0552c550ac2ddfd0f8c9766b0c29b961c2c3aa8 2414 libyaml-syck-perl_1.47-1.dsc
 7c421304c7b213127862c667a3f438c06fd712a8 270328 libyaml-syck-perl_1.47.orig.tar.gz
 db399c620a6936b260fd21395bd73f0c8f5619bd 7376 libyaml-syck-perl_1.47-1.debian.tar.xz
Checksums-Sha256:
 cbf09b3fe6f9ab20436677ccb255231695ef38bea81be04187f426368cef0c53 2414 libyaml-syck-perl_1.47-1.dsc
 672196ca1c021e3c68f4b5f7b4aec305ad471bbbf448c53c7e40034d6ebb7e1d 270328 libyaml-syck-perl_1.47.orig.tar.gz
 dd47e6d2895009db7dad157154801602db32cb5814e07825ec9eb3b50f9c46f4 7376 libyaml-syck-perl_1.47-1.debian.tar.xz
Files:
 02b160cb2c4a239e686d1329e1272884 2414 perl optional libyaml-syck-perl_1.47-1.dsc
 c9202ef678821a1e723defed86353faf 270328 perl optional libyaml-syck-perl_1.47.orig.tar.gz
 edb3524a9b347cd683e0c7ac51a8328c 7376 perl optional libyaml-syck-perl_1.47-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEE0eExbpOnYKgQTYX6uzpoAYZJqgYFAmpaJ39fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEQx
RTEzMTZFOTNBNzYwQTgxMDREODVGQUJCM0E2ODAxODY0OUFBMDYACgkQuzpoAYZJ
qgbIUhAArjCtyT/GXQXx7jh1DrN7In/Oje1CagSS5KfcFt8ks9guSMIO9EhxKXg0
B38PNC5Xu3tiqe9hu3+2KynhehcwiWM+R5iKc6J5W4i5HmOEd7BoxDPO6vgv5Eof
oWzpSft498C0sKZ0lWYQGFgfmxCaiTvv/ddNbiNOGhzSg9d8cUMIILyVHry4dcb+
oqkvRjufAUWLBpYPm9XZzV8yi7JHywUoUCl+c7APbEnwCuJcTncHGTWKzoEOauC8
UeTcV0kymTL6y/hqjHxJNY9nWdizuxn9mnz4A7AnsP8bkN7izizCTiwWp152410k
1ExxlSoHJIiiG/ibD3AwSiUB2SPVV01mXEpAh7hJQP7UEUTQmm/+i1034HMShk7B
WfpMufJ5IqeozmD2cOBFuhdc/rO8iCqQaQ9cVaphZYiRstGwl6A4iUZX1otVfqD7
NWB59MaHwQeihO/7g4aOylhmYDMMmFETru9iUtEMT2EQU5Wu5WlldmhDvezsQX+a
Plwjj2ZM+gMd8Kra52eFn2uQX2PFTAdpcVDHDeBiVYCh9bvXziF/+R3rbYSM8+hc
4agoud+4oUush52qTgLGcTMGT+tjXFJwyd1FauKxuCVbOnapJbu4Q7tYOPo6omDf
i3bGJ4ZG2WEeAmX5/Fcd3P5DbQy6p165jIweXZkadPnjYX/HC3I=
=YhBM
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
libyaml-syck-perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142267@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated libyaml-syck-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 08 Aug 2026 11:20:57 +0200
Source: libyaml-syck-perl
Architecture: source
Version: 1.34-2+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 1142267
Changes:
 libyaml-syck-perl (1.34-2+deb13u3) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * fix: prevent buffer underflow in base60 (sexagesimal) parsing
     (CVE-2026-5089)
   * rebase: apply review feedback
   * fix: prevent memory leaks when Load/LoadJSON croak on parse errors
   * Fix four libsyck memory-safety CVEs reachable from YAML::Syck::Load()
     (CVE-2026-57075, CVE-2026-57076, CVE-2026-57077, CVE-2026-13713)
     (Closes: #1142267)
Checksums-Sha1:
 e5d2a528afbc86133836b622c372c2371693b7d7 2352 libyaml-syck-perl_1.34-2+deb13u3.dsc
 e3064e78a7d530ff6bc14dbeaa01fd68de843657 18808 libyaml-syck-perl_1.34-2+deb13u3.debian.tar.xz
Checksums-Sha256:
 1cbbc5a030d507c2ae809a334e10a872f5cafd1bcd961ab8eb420534678c8ad2 2352 libyaml-syck-perl_1.34-2+deb13u3.dsc
 7d665301076b26ab406b560a4bb88d27be3141454a130512297b18417c0c1aa1 18808 libyaml-syck-perl_1.34-2+deb13u3.debian.tar.xz
Files:
 fdef0b5b3e5b15702ecb4c72ba762a31 2352 perl optional libyaml-syck-perl_1.34-2+deb13u3.dsc
 b0ff053c8aa9d0b7c9301a190ba594b5 18808 perl optional libyaml-syck-perl_1.34-2+deb13u3.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmp3Ti5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89E48AP/3QuIeJR46KJqpoej17DXe+pCj1XrHJ3
bZAMsGeqtaqnrO1xLr/lxJtdm4Q6d8vaViQOZRTjlKGx1uvpEUTNF/ifLVj1hbX5
XCD4SMtKUEAd3F5QMHltk+4KK9nsv4LJNxy6/WxsIZgHF2SZ3iBhGdmRMJLnYnDu
JyEWEhV9TLyvqfwNseilfSDLNdZERD1pff9BMK83CaPADm5DWtTXvWPr7KNXP4Hx
zuALWJNiV6dWJFVUotW4zCwqiGAZN29PzLAmPX4hS979UxjjWVgUbrI0ENCc1IQT
zbQlM2dhKQTrTS3WqNGCNNQMTphbUyVE7QBtpPwmRkifMSFGf8ltNPrdQgWwoJEv
fwjnB7EflbVCOWXgYNKbl+4/w4brIm8CgWgPi/zh5cgwpJaBFNd6qQOvrtKiBkA3
Nk/3IyiombnjMmfqcZ8Lsz6jrPKoZwo07co8+Wfic2IZ7jkiAwXkJ50BqVFAISsC
7mlx8qtQbUgZBiWlJx4JzCDveD8TIayPHJN1LdcKHNF332wSwB+ziEfHahM8+5cH
In6bD9frDcG3Evys64gi0U0i8C5++uKZ2IBeagewkylW8UC31ox9IGOJxgKpST66
CJOVUXWp38HtjBylHOKZzPWK4qNzCN8el41FJOHCaUy2jdY7e+Cz59sLDDKPfp++
fHcKkD5ihPSZ
=nOzS
-----END PGP SIGNATURE-----