Perl Modules Libyaml-syck-perl and Libxml-bare-perl Hit by Six Memory Corruption and DoS Flaws
Six vulnerabilities in Perl's libyaml-syck-perl and libxml-bare-perl modules were disclosed on July 17, 2026, posing risks of memory corruption and denial-of-service.
Key findings
- Six vulnerabilities disclosed on July 17, 2026, affect Perl modules libyaml-syck-perl and libxml-bare-perl.
- libyaml-syck-perl (pre-1.47) has four memory corruption flaws: use-after-free, double-free, and out-of-bounds reads.
- libxml-bare-perl (through 0.53) has two parsing flaws: unbounded lookahead and infinite loop on malformed attributes.
- Vulnerabilities primarily lead to denial-of-service conditions and potential information disclosure.
- Users should update libyaml-syck-perl to 1.47+ and libxml-bare-perl to versions beyond 0.53.
On July 17, 2026, a batch of six vulnerabilities was disclosed affecting Perl modules, specifically libyaml-syck-perl and libxml-bare-perl. These vulnerabilities, all disclosed on the same day, primarily involve memory corruption issues and parsing vulnerabilities that could lead to denial-of-service conditions. The disclosures highlight potential risks for applications relying on these modules for YAML and XML processing.
The libyaml-syck-perl module, specifically versions before 1.47, is impacted by four distinct vulnerabilities:
CVE-2026-57076: A heap use-after-free vulnerability stemming from the reuse of an anchor name as a key in the anchors table within the bundledlibsycklibrary.CVE-2026-57075: An out-of-bounds read vulnerability in the base64 decoder (syck_base64dec) due to a signed-char index into a lookup table, which can lead to reading before the table's bounds for byte values greater than or equal to 0x80.CVE-2026-13713: A use-after-free and double-free vulnerability where an anchor node is freed while still present on the parser's value stack.CVE-2026-57077: An out-of-bounds read vulnerability caused by an unbounded newline scan innewline_lenwithinlibsyck, which can occur during block-scalar parsing at a document boundary.
The libxml-bare-perl module, versions through 0.53, is affected by two vulnerabilities:
CVE-2026-57074: An unbounded character lookahead in theparserc_parsefunction. This flaw allows the parser to attempt to check for multi-character strings or element terminators without validating offsets within the buffer, potentially leading to out-of-bounds reads with truncated strings.CVE-2026-13401: An infinite loop vulnerability when parsing malformed attributes. Theparserc_parsefunction can fail to advance its state cursor on certain malformed attribute forms, causing the parser to hang indefinitely.
The collective impact of these vulnerabilities ranges from denial-of-service (DoS) through infinite loops or memory corruption, to potential information disclosure via out-of-bounds reads. While no specific threat actor or active exploitation was mentioned in the disclosures, the nature of these bugs means that specially crafted YAML or XML input could trigger these conditions.
Users of libyaml-syck-perl should update to version 1.47 or later. For libxml-bare-perl, versions through 0.53 are affected, implying that updating to a later version, if available, is recommended. Specific patch versions were not detailed in the provided information, but the disclosed versions indicate the range of vulnerable code.
This batch of vulnerabilities underscores the importance of secure parsing of untrusted data in widely used programming language modules. Developers relying on these Perl modules should prioritize updating to patched versions to mitigate the risks associated with memory corruption and parsing errors. Further monitoring for any advisories from the Perl Foundation or Debian security teams is advised.