Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Perl YAML::Syck may expose data in complex files
published 1 year ago
Summary
The Perl YAML::Syck library (azure/perl-yaml-syck) version 1.34-1 can read beyond its intended memory area when processing certain complex YAML files, potentially leaking information stored nearby. This happens because the code lacks proper end‑of‑string markers. Update to version 1.36 or later, or stop using the affected version, to close the gap.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | perl-yaml-syck | <= 1.34-1 |
Original advisory text
CVE-2025-11683 affecting package perl-YAML-Syck 1.34-1
YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure
Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read
The issue is seen with complex YAML files with a hash of all keys and empty values. There is no indication that the issue leads to accessing memory outside that allocated to the module.
Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read
The issue is seen with complex YAML files with a hash of all keys and empty values. There is no indication that the issue leads to accessing memory outside that allocated to the module.
References
Timeline
Published16 Oct 2025
Updated21 Oct 2026
First seen21 Oct 2026
Sources
AZL-109466 · OSV
Track software like this
Free during beta