{"id":"CVE-2026-5089","state":"PUBLISHED","title":"YAML::Syck versions before 1.38 for Perl has an out-of-bounds read","description":"YAML::Syck versions before 1.38 for Perl  has an out-of-bounds read.\n\nThe base60 (sexagesimal) parsing code in perl_syck.h has a buffer underflow bug in both int#base60 and float#base60 handlers. When processing the leftmost segment of a colon-separated value (e.g., the 1 in 1:30:45), the inner while loop can decrement a pointer past the start of the string buffer:\n\n    while ( colon >= ptr && *colon != ':' )\n    {\n        colon--;\n    }\n    if ( *colon == ':' ) *colon = '\\0';  // colon may be ptr-1 here\n\nWhen no colon is found (final/leftmost segment), colon becomes ptr-1, and the subsequent *colon dereference reads one byte before the allocated buffer.","publishedAt":"2026-05-12T16:14:21.951Z","updatedAt":"2026-05-14T13:51:01.952Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"CISA-ADP"},"assigner":"CPANSec","products":["TODDR YAML::Syck"],"affected":[{"vendor":"TODDR","product":"YAML::Syck","packageName":"YAML-Syck","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.38","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","programFiles":["perl_syck.h"],"repo":"https://github.com/toddr/YAML-Syck"}],"references":["https://metacpan.org/release/TODDR/YAML-Syck-1.38/changes","https://github.com/cpan-authors/YAML-Syck/issues/132","https://github.com/cpan-authors/YAML-Syck/pull/133","https://github.com/cpan-authors/YAML-Syck/commit/208a4d3bd1b5cdb4a791a6e3905bd6bd45e9d005.patch","http://www.openwall.com/lists/oss-security/2026/05/12/16"],"weaknesses":["CWE-124"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/5xxx/CVE-2026-5089.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-5089","state":"PUBLISHED","datePublished":"2026-05-12T16:14:21.951Z","dateUpdated":"2026-05-14T13:51:01.952Z","assignerShortName":"CPANSec","assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateReserved":"2026-03-28T19:33:37.653Z"},"containers":{"cna":{"title":"YAML::Syck versions before 1.38 for Perl has an out-of-bounds read","descriptions":[{"lang":"en","value":"YAML::Syck versions before 1.38 for Perl  has an out-of-bounds read.\n\nThe base60 (sexagesimal) parsing code in perl_syck.h has a buffer underflow bug in both int#base60 and float#base60 handlers. When processing the leftmost segment of a colon-separated value (e.g., the 1 in 1:30:45), the inner while loop can decrement a pointer past the start of the string buffer:\n\n    while ( colon >= ptr && *colon != ':' )\n    {\n        colon--;\n    }\n    if ( *colon == ':' ) *colon = '\\0';  // colon may be ptr-1 here\n\nWhen no colon is found (final/leftmost segment), colon becomes ptr-1, and the subsequent *colon dereference reads one byte before the allocated buffer."}],"affected":[{"vendor":"TODDR","product":"YAML::Syck","packageName":"YAML-Syck","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.38","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","programFiles":["perl_syck.h"],"repo":"https://github.com/toddr/YAML-Syck"}],"references":[{"url":"https://metacpan.org/release/TODDR/YAML-Syck-1.38/changes","tags":["release-notes"]},{"url":"https://github.com/cpan-authors/YAML-Syck/issues/132","tags":["issue-tracking"]},{"url":"https://github.com/cpan-authors/YAML-Syck/pull/133","tags":["issue-tracking"]},{"url":"https://github.com/cpan-authors/YAML-Syck/commit/208a4d3bd1b5cdb4a791a6e3905bd6bd45e9d005.patch","tags":["patch"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-124","description":"CWE-124 Buffer Underwrite ('Buffer Underflow')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CPANSec","orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateUpdated":"2026-05-12T16:14:21.951Z"},"solutions":[{"lang":"en","value":"Upgrade to YAML::Syck version 1.38 or later."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"cpansec-cna-tool 0.1"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/05/12/16"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-05-12T18:35:46.042Z"}},{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/cpan-authors/YAML-Syck/issues/132","tags":["exploit"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-05-14T13:50:53.123874Z","id":"CVE-2026-5089","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-14T13:51:01.952Z"}}]}}}