TODDR YAML::Syck up to 1.46 Lexer newline_len out-of-bounds

Summaryinfo

A vulnerability was found in TODDR YAML::Syck up to 1.46. It has been rated as critical. This affects the function newline_len of the component Lexer. The manipulation leads to out-of-bounds. This vulnerability is listed as CVE-2026-57077. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in TODDR YAML::Syck up to 1.46. It has been rated as critical. This issue affects the function newline_len of the component Lexer. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover. Any caller that runs Load or LoadFile on an untrusted document with a block scalar at a document boundary reaches the over-read.

The advisory is shared at metacpan.org. The identification of this vulnerability is CVE-2026-57077 since 06/23/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 327546 (Linux Distros Unpatched Vulnerability : CVE-2026-57077), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.47 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (327546), EUVD (EUVD-2026-45056) and CERT Bund (WID-SEC-2026-2508). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• cPanel cPanel/WHM

Productinfo

Vendor

• TODDR

Name

• YAML::Syck

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41
• 1.42
• 1.43
• 1.44
• 1.45
• 1.46

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion