CVE-2026-13713— toddr YAML::Syck 资源管理错误漏洞

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.

N/A

释放后使用

toddr YAML::Syck 资源管理错误漏洞

toddr YAML::Syck是toddr个人开发者的Perl语言模块,用于解析和生成YAML格式数据。 toddr YAML::Syck 1.47之前版本存在资源管理错误漏洞，该漏洞源于解析器值栈上的锚节点仍在使用时被释放，导致释放后重用和双重释放，可能造成解释器崩溃，导致拒绝服务。

N/A

N/A