CVE-2026-5089

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5089", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-03-28T19:33:37.653Z", "datePublished": "2026-05-12T16:14:21.951Z", "dateUpdated": "2026-05-14T13:51:01.952Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "YAML-Syck", "product": "YAML::Syck", "programFiles": ["perl_syck.h"], "repo": "https://github.com/toddr/YAML-Syck", "vendor": "TODDR", "versions": [{"lessThan": "1.38", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "YAML::Syck versions before 1.38 for Perl has an out-of-bounds read.\n\nThe base60 (sexagesimal) parsing code in perl_syck.h has a buffer underflow bug in both int#base60 and float#base60 handlers. When processing the leftmost segment of a colon-separated value (e.g., the 1 in 1:30:45), the inner while loop can decrement a pointer past the start of the string buffer:\n\n while ( colon >= ptr && *colon != ':' )\n {\n colon--;\n }\n if ( *colon == ':' ) *colon = '\\0'; // colon may be ptr-1 here\n\nWhen no colon is found (final/leftmost segment), colon becomes ptr-1, and the subsequent *colon dereference reads one byte before the allocated buffer."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-124", "description": "CWE-124 Buffer Underwrite ('Buffer Underflow')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-12T16:14:21.951Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/TODDR/YAML-Syck-1.38/changes"}, {"tags": ["issue-tracking"], "url": "https://github.com/cpan-authors/YAML-Syck/issues/132"}, {"tags": ["issue-tracking"], "url": "https://github.com/cpan-authors/YAML-Syck/pull/133"}, {"tags": ["patch"], "url": "https://github.com/cpan-authors/YAML-Syck/commit/208a4d3bd1b5cdb4a791a6e3905bd6bd45e9d005.patch"}], "solutions": [{"lang": "en", "value": "Upgrade to YAML::Syck version 1.38 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "YAML::Syck versions before 1.38 for Perl has an out-of-bounds read", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/12/16"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-12T18:35:46.042Z"}}, {"references": [{"url": "https://github.com/cpan-authors/YAML-Syck/issues/132", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T13:50:53.123874Z", "id": "CVE-2026-5089", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T13:51:01.952Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/12/16"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-12T18:35:46.042Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-5089", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T13:50:53.123874Z"}}}], "references": [{"url": "https://github.com/cpan-authors/YAML-Syck/issues/132", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T13:48:57.516Z"}}], "cna": {"title": "YAML::Syck versions before 1.38 for Perl has an out-of-bounds read", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/toddr/YAML-Syck", "vendor": "TODDR", "product": "YAML::Syck", "versions": [{"status": "affected", "version": "0", "lessThan": "1.38", "versionType": "custom"}], "packageName": "YAML-Syck", "programFiles": ["perl_syck.h"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to YAML::Syck version 1.38 or later."}], "references": [{"url": "https://metacpan.org/release/TODDR/YAML-Syck-1.38/changes", "tags": ["release-notes"]}, {"url": "https://github.com/cpan-authors/YAML-Syck/issues/132", "tags": ["issue-tracking"]}, {"url": "https://github.com/cpan-authors/YAML-Syck/pull/133", "tags": ["issue-tracking"]}, {"url": "https://github.com/cpan-authors/YAML-Syck/commit/208a4d3bd1b5cdb4a791a6e3905bd6bd45e9d005.patch", "tags": ["patch"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "YAML::Syck versions before 1.38 for Perl has an out-of-bounds read.\n\nThe base60 (sexagesimal) parsing code in perl_syck.h has a buffer underflow bug in both int#base60 and float#base60 handlers. When processing the leftmost segment of a colon-separated value (e.g., the 1 in 1:30:45), the inner while loop can decrement a pointer past the start of the string buffer:\n\n while ( colon >= ptr && *colon != ':' )\n {\n colon--;\n }\n if ( *colon == ':' ) *colon = '\\0'; // colon may be ptr-1 here\n\nWhen no colon is found (final/leftmost segment), colon becomes ptr-1, and the subsequent *colon dereference reads one byte before the allocated buffer."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-124", "description": "CWE-124 Buffer Underwrite ('Buffer Underflow')"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-12T16:14:21.951Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5089", "state": "PUBLISHED", "dateUpdated": "2026-05-14T13:51:01.952Z", "dateReserved": "2026-03-28T19:33:37.653Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-05-12T16:14:21.951Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "YAML-Syck", "product": "YAML::Syck", "programFiles": ["perl_syck.h"], "repo": "https://github.com/toddr/YAML-Syck", "vendor": "TODDR", "versions": [{"lessThan": "1.38", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "YAML::Syck versions before 1.38 for Perl has an out-of-bounds read.\n\nThe base60 (sexagesimal) parsing code in perl_syck.h has a buffer underflow bug in both int#base60 and float#base60 handlers. When processing the leftmost segment of a colon-separated value (e.g., the 1 in 1:30:45), the inner while loop can decrement a pointer past the start of the string buffer:\n\n while ( colon >= ptr && *colon != ':' )\n {\n colon--;\n }\n if ( *colon == ':' ) *colon = '\\0'; // colon may be ptr-1 here\n\nWhen no colon is found (final/leftmost segment), colon becomes ptr-1, and the subsequent *colon dereference reads one byte before the allocated buffer."}, {"lang": "es", "value": "Las versiones de YAML::Syck anteriores a la 1.38 para Perl tienen una lectura fuera de l\u00edmites.\n\nEl c\u00f3digo de an\u00e1lisis (parsing) base60 (sexagesimal) en perl_syck.h tiene un error de subdesbordamiento de b\u00fafer en los manejadores int#base60 y float#base60. Al procesar el segmento m\u00e1s a la izquierda de un valor separado por dos puntos (p. ej., el 1 en 1:30:45), el bucle \u2019while\u2019 interno puede decrementar un puntero m\u00e1s all\u00e1 del inicio del b\u00fafer de cadena:\n\n while ( colon >= ptr && colon != \u2019:\u2019 )\n {\n colon--;\n }\n if ( colon == \u2019:\u2019 ) colon = \u2019\\0\u2019; // \u2019colon\u2019 puede ser \u2019ptr-1\u2019 aqu\u00ed\n\nCuando no se encuentra ning\u00fan dos puntos (segmento final/m\u00e1s a la izquierda), \u2019colon\u2019 se convierte en \u2019ptr-1\u2019, y la desreferencia subsiguiente de colon lee un byte antes del b\u00fafer asignado."}], "id": "CVE-2026-5089", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5089", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-14T13:50:53.123874Z", "version": "2.0.3"}}]}, "published": "2026-05-12T17:16:21.720", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/cpan-authors/YAML-Syck/commit/208a4d3bd1b5cdb4a791a6e3905bd6bd45e9d005.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/cpan-authors/YAML-Syck/issues/132"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/cpan-authors/YAML-Syck/pull/133"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/TODDR/YAML-Syck-1.38/changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/05/12/16"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/cpan-authors/YAML-Syck/issues/132"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-124"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-YAML-Syck: perl-YAML-Syck: Information disclosure via out-of-bounds read in base60 parsing", "id": "2476554", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476554"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in perl-YAML-Syck. The base60 (sexagesimal) parsing code in perl_syck.h contains a buffer underflow vulnerability. When processing specially crafted colon-separated values, an attacker could cause the parser to read one byte before the allocated buffer. This out-of-bounds read may lead to information disclosure."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-5089", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "perl-YAML-Syck", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "perl-YAML-Syck", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2026-05-12T16:14:21Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-5089\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-5089\nhttps://github.com/cpan-authors/YAML-Syck/commit/208a4d3bd1b5cdb4a791a6e3905bd6bd45e9d005.patch\nhttps://github.com/cpan-authors/YAML-Syck/issues/132\nhttps://github.com/cpan-authors/YAML-Syck/pull/133\nhttps://metacpan.org/release/TODDR/YAML-Syck-1.38/changes"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.38)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "YAML::Syck", "source": "cna", "vendor": "TODDR"}, "product": "yaml::syck", "vendor": "toddr"}], "created": "2026-05-12T17:45:20.098305+00:00", "updated": "2026-05-25T14:00:17.147219+00:00", "vendors": ["toddr", "toddr$PRODUCT$yaml::syck"]}