CVE-2026-4177

YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.<br /> <br /> The heap overflow occurs when class names exceed the initial 512-byte allocation.<br /> <br /> The base64 decoder could read past the buffer end on trailing newlines.<br /> <br /> strtok mutated n-&gt;type_id in place, corrupting shared node data.<br /> <br /> A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string &amp;#39;a&amp;#39; was leaked on early return.