This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags:
CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input
CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared between the node and the anchors table
CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683)
CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input
There are also a few other bug-fixes included.
This update has been submitted for testing by pghmcfc.
This update has been submitted for testing by pghmcfc.
This update's test gating status has been changed to 'ignored'.
This update has been pushed to testing.
pghmcfc edited this update.
This update has been submitted for stable by bodhi.
This update has been pushed to stable.