Hi,

The following vulnerability was published for libfyaml.

CVE-2026-88359[0]:
| libfyaml 0.9.6 contains a stack exhaustion vulnerability in
| fy_atom_iter_format(). When processing a specially crafted YAML
| document containing a very large literal or folded block scalar, the
| function repeatedly grows an internal buffer using alloca() inside a
| loop. The allocated stack memory is not released until the function
| returns, causing cumulative stack growth that can exceed the process
| stack limit and result in SIGSEGV and denial of service.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-88359
https://www.cve.org/CVERecord?id=CVE-2026-88359
[1] https://github.com/pantoniou/libfyaml/issues/315
[2] https://github.com/pantoniou/libfyaml/commit/12d903a5c9163d15edf2ef9d7311bd0d1505d902

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore