https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 08:41:39 +0000 https://vulnerability.circl.lu/vuln/cve-2026-57076 <p><strong>Affected:</strong> TODDR YAML::Syck</p> <p>YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor.</p> <p>In the bundled libsyck an anchor name allocated by syck_strndup is stored both as node-&gt;anchor, freed when the node is freed, and as the key in the parser&#39;s anchors table. Freeing the node frees the shared key, and a later anchor redefinition makes st_delete compare against the freed key, so st_strcmp reads freed heap memory. Anchors are a standard YAML feature and need no special flags, so this is reached on the default Load path.</p> <p>Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor reaches the read of freed memory.</p> <p><strong>Affected:</strong> TODDR YAML::Syck</p> <p>YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor.</p> <p>In the bundled libsyck an anchor name allocated by syck_strndup is stored both as node-&gt;anchor, freed when the node is freed, and as the key in the parser&#39;s anchors table. Freeing the node frees the shared key, and a later anchor redefinition makes st_delete compare against the freed key, so st_strcmp reads freed heap memory. Anchors are a standard YAML feature and need no special flags, so this is reached on the default Load path.</p> <p>Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor reaches the read of freed memory.</p> https://vulnerability.circl.lu/vuln/cve-2026-57076