CVE-2026-4177
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
CWE-122
Desbordamiento de búfer basado en memoria dinámica (Heap)
Fecha de publicación:
16/03/2026
Última modificación:
17/03/2026
Descripción
*** Pendiente de traducción *** YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter.<br />
<br />
The heap overflow occurs when class names exceed the initial 512-byte allocation.<br />
<br />
The base64 decoder could read past the buffer end on trailing newlines.<br />
<br />
strtok mutated n->type_id in place, corrupting shared node data.<br />
<br />
A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string &#39;a&#39; was leaked on early return.
Impacto
Puntuación base 3.x
9.10
Gravedad 3.x
CRÍTICA