CVE-2026-13713

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13713", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-06-29T13:57:19.498Z", "datePublished": "2026-07-16T21:35:31.477Z", "dateUpdated": "2026-07-17T13:18:02.930Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "YAML-Syck", "product": "YAML::Syck", "programFiles": ["handler.c", "syck_.c", "syck.h"], "programRoutines": [{"name": "syck_hdlr_add_anchor"}, {"name": "syck_hdlr_remove_anchor"}, {"name": "syck_hdlr_add_node"}], "repo": "https://github.com/toddr/YAML-Syck", "vendor": "TODDR", "versions": [{"lessThan": "1.47", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.\n\nIn the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.\n\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-415", "description": "CWE-415 Double Free", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-16T21:35:31.477Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes"}, {"tags": ["patch"], "url": "https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch"}], "solutions": [{"lang": "en", "value": "Upgrade to YAML-Syck 1.47 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/17/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-17T03:02:25.421Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-17T13:17:36.382946Z", "id": "CVE-2026-13713", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T13:18:02.930Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/17/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-17T03:02:25.421Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-13713", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T13:17:36.382946Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T13:17:58.545Z"}}], "cna": {"title": "YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/toddr/YAML-Syck", "vendor": "TODDR", "product": "YAML::Syck", "versions": [{"status": "affected", "version": "0", "lessThan": "1.47", "versionType": "custom"}], "packageName": "YAML-Syck", "programFiles": ["handler.c", "syck_.c", "syck.h"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "syck_hdlr_add_anchor"}, {"name": "syck_hdlr_remove_anchor"}, {"name": "syck_hdlr_add_node"}]}], "solutions": [{"lang": "en", "value": "Upgrade to YAML-Syck 1.47 or later."}], "references": [{"url": "https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes", "tags": ["release-notes"]}, {"url": "https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch", "tags": ["patch"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.\n\nIn the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.\n\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "CWE-415 Double Free"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-16T21:35:31.477Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13713", "state": "PUBLISHED", "dateUpdated": "2026-07-17T13:18:02.930Z", "dateReserved": "2026-06-29T13:57:19.498Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-07-16T21:35:31.477Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "YAML-Syck", "product": "YAML::Syck", "programFiles": ["handler.c", "syck_.c", "syck.h"], "programRoutines": [{"name": "syck_hdlr_add_anchor"}, {"name": "syck_hdlr_remove_anchor"}, {"name": "syck_hdlr_add_node"}], "repo": "https://github.com/toddr/YAML-Syck", "vendor": "TODDR", "versions": [{"lessThan": "1.47", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.\n\nIn the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.\n\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service."}, {"lang": "es", "value": "Las versiones de YAML::Syck anteriores a la 1.47 para Perl permiten un uso despu\u00e9s de liberaci\u00f3n y una doble liberaci\u00f3n a trav\u00e9s de un nodo ancla liberado mientras a\u00fan est\u00e1 en la pila de valores del analizador.\n\nEn la libsyck incluida, cuando un nombre de ancla es redefinido o eliminado, syck_hdlr_add_anchor y syck_hdlr_remove_anchor liberan el nodo almacenado bajo ese nombre con syck_free_node. Ese nodo a\u00fan puede estar activo en la pila de valores del analizador, por lo que syck_hdlr_add_node lo alcanza de nuevo y lo libera una segunda vez. En una compilaci\u00f3n normal, el fragmento de nodo de 48 bytes es liberado dos veces y el int\u00e9rprete aborta. Los anclas no necesitan banderas especiales, por lo que esto se alcanza en la ruta de carga (Load) predeterminada, y un documento de 7 bytes que redefine un ancla lo activa.\n\nCualquier llamador que ejecute Load o LoadFile en un documento no confiable que redefine un ancla a mitad del an\u00e1lisis bloquea el int\u00e9rprete, una denegaci\u00f3n de servicio."}], "id": "CVE-2026-13713", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13713", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-17T13:17:36.382946Z", "version": "2.0.3"}}]}, "published": "2026-07-16T22:16:59.640", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/07/17/1"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}, {"lang": "en", "value": "CWE-416"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document", "id": "2501564", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501564"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1341", "details": ["YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.\nIn the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.", "A flaw was found in YAML::Syck. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted YAML document. The flaw occurs due to a use-after-free and double-free condition when an anchor node is redefined while still on the parser's value stack, leading to the interpreter crashing."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-13713", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "perl-YAML-Syck", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "perl-YAML-Syck", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "perl-YAML-Syck", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2026-07-16T21:35:31Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-13713\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-13713\nhttps://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch\nhttps://metacpan.org/release/TODDR/YAML-Syck-1.47/changes"], "statement": "This Important vulnerability in `perl-YAML-Syck` can lead to a denial of service when processing untrusted YAML documents. The flaw, a use-after-free and double-free, causes the interpreter to crash if a specially crafted YAML document redefines an anchor during parsing. This poses a risk to Red Hat systems that handle external YAML input without sufficient validation.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.47)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "YAML::Syck", "source": "cna", "vendor": "TODDR"}, "product": "yaml::syck", "vendor": "toddr"}], "created": "2026-07-16T22:30:06.640833+00:00", "updated": "2026-07-31T01:15:18.448153+00:00", "vendors": ["toddr", "toddr$PRODUCT$yaml::syck"]}