CVE-2026-88359 in libfyaml
Summary
by MITRE • 09/24/2026
libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a very large literal or folded block scalar, the function repeatedly grows an internal buffer using alloca() inside a loop. The allocated stack memory is not released until the function returns, causing cumulative stack growth that can exceed the process stack limit and result in SIGSEGV and denial of service.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in libfyaml version 0.9.6 represents a critical resource exhaustion flaw within the fy_atom_iter_format() function, classified under CWE-787: Out-of-bounds Write and CWE-121: Stack-based Buffer Overflow due to its mechanism of uncontrolled stack growth. This issue arises from an improper handling of memory allocation during the parsing of YAML documents that contain exceptionally large literal or folded block scalars. The core technical flaw lies in the use of alloca() within a loop structure, where internal buffers are repeatedly expanded without releasing previously allocated stack space. Unlike heap-allocated memory which is managed by dynamic allocators and can be freed incrementally, stack memory allocated via alloca() persists for the duration of the function call. Consequently, as the parser processes large block scalars, it continuously pushes data onto the process stack, leading to cumulative growth that eventually exceeds the operating system's configured stack size limit.
From an operational perspective, this vulnerability allows a remote or local attacker to trigger a denial of service condition by supplying a maliciously crafted YAML input file. When the parser encounters these oversized block scalars, it initiates the problematic allocation loop, rapidly consuming available stack space until the process receives a SIGSEGV signal and terminates abruptly. This behavior effectively crashes any application relying on libfyaml for parsing untrusted or large-scale YAML data, disrupting service availability without requiring authentication or privilege escalation. The impact is particularly severe in server-side applications where such inputs might be accepted via API endpoints or file uploads, potentially leading to repeated process restarts and resource contention that degrades overall system stability.
This vulnerability aligns with the MITRE ATT&CK technique T1496: Resource Hijacking, specifically under the sub-technique of CPU or Memory Consumption, as it exploits a logic error to consume system resources beyond intended limits. It also reflects CWE-789 which describes memory allocation without proper bounds checking, leading to stack exhaustion. To mitigate this risk, developers should immediately upgrade libfyaml to patched versions where the internal buffer management has been refactored to use heap-based allocations or fixed-size buffers that do not rely on alloca() for large data structures. Additionally, input validation mechanisms should be implemented at the application layer to enforce strict limits on the size of block scalars before they are passed to the parser library. Implementing these controls ensures that even if a malicious payload is submitted, it will be rejected prior to triggering the vulnerable code path, thereby preserving system integrity and availability.