TODDR YAML::Syck up to 1.36 on Perl base64 Decoder heap-based overflow

Summaryinfo

A vulnerability marked as critical has been reported in TODDR YAML::Syck up to 1.36 on Perl. Affected by this issue is some unknown functionality of the component base64 Decoder. The manipulation leads to heap-based overflow. This vulnerability is documented as CVE-2026-4177. The attack can be initiated remotely. There is not any exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in TODDR YAML::Syck up to 1.36 on Perl. It has been rated as critical. This issue affects an unknown code of the component base64 Decoder. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. The heap overflow occurs when class names exceed the initial 512-byte allocation. The base64 decoder could read past the buffer end on trailing newlines. strtok mutated n->type_id in place, corrupting shared node data. A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.

The weakness was released by Todd Rinaldo as e8844a31c8cf0052914b198fc784ed4e6b8ae69e. The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-4177 since 03/14/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 302536 (Linux Distros Unpatched Vulnerability : CVE-2026-4177), which helps to determine the existence of the flaw in a target environment.

Applying the patch e8844a31c8cf0052914b198fc784ed4e6b8ae69e is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (302536) and EUVD (EUVD-2026-12523). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• TODDR

Name

• YAML::Syck

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion