CVE-2026-13713Disclosure

LOWCVSS 6.2 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-415CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 4 classified signals
Peaked 3d ago at 2 mentions (2026-07-16); latest day: 1
5 total mentions across 4 days

Deep dive

Activity timeline5 mentions / 4d

Signal classification2 categories

Disclosure

480.0%

Patch

120.0%

Referenced assets9 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-16	2	Disclosure2
2026-07-17	1	Disclosure1
2026-07-19	1	Disclosure1
2026-07-20	1	Patch1

Full discourse5 posts

Open Source Security mailing list@oss_security89d
Disclosure
Perl CPAN YAML::Syck before 1.47 CVE-2026-13713: Use-after-free and double-free https://www.openwall.com/lists/oss-security/2026/07/17/1 CVE-2026-57075: Out-of-bounds read https://www.openwall.com/lists/oss-security/2026/07/17/2 CVE-2026-57076: Use-after-free https://www.openwall.com/lists/oss-security/2026/07/17/3 CVE-2026-57077: Out-of-bounds read https://www.openwall.com/lists/oss-security/2026/07/17/4
Post summary
The note lists multiple CVEs for Perl CPAN YAML::Syck with corresponding vulnerability types but provides no PoC, exploit, patch information, or evidence of active exploitation.
1000064
4.7K followersView on X
VulniPulse@vulnipulse88d
Patch
⚠️ Red Hat Enterprise Linux 6 alert: CVE-2026-13713 (CVSS 7.5) Remote attackers could disrupt service or cause a denial of service. Apply the vendor-recommended mitigation. https://vulnipulse.com/advisories/linux-cve-2026-13713 #Linux #RedHatEnterpriseLinux6 #CyberSecurity #CVE
Post summary
Red Hat released a mitigation for CVE‑2026‑13713, a denial‑of‑service vulnerability with a CVSS score of 7.5, but no PoC, exploit code, or evidence of active exploitation has been reported.
0000033
6 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-13713 Use-After-Free and Double-Free in YAML::Syck Before 1.47 for Perl https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-13713 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The tweet announces CVE‑2026‑13713, a use‑after‑free and double‑free vulnerability in YAML::Syck before 1.47 for Perl, and links to vulnerability details and alert subscriptions.
0000094
4.1K followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-13713 YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyc… https://www.cve.org/CVERecord?id=CVE-2026-13713 ----- Traducción: CVE-2026-13713 YAM… http://infoflow.cloud`
Post summary
The post discloses CVE‑2026‑13713, providing technical details of the use‑after‑free and double‑free flaw, but offers no PoC, exploit, patch, or active exploitation evidence.
0000029
92 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-13713 YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyc… https://www.cve.org/CVERecord?id=CVE-2026-13713
Post summary
CVE-2026-13713 is disclosed as a use‑after‑free and double‑free flaw in YAML::Syck before version 1.47, with no PoC, exploit code, or evidence of active exploitation mentioned.
00000656
57.8K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-13713

VulniPulse[verified]@vulnipulsePatch

Red Hat released a mitigation for CVE‑2026‑13713, a denial‑of‑service vulnerability with a CVSS score of 7.5, but no PoC, exploit code, or evidence of active exploitation has been reported.

Open Source Security mailing list@oss_securityDisclosure

The note lists multiple CVEs for Perl CPAN YAML::Syck with corresponding vulnerability types but provides no PoC, exploit, patch information, or evidence of active exploitation.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The tweet announces CVE‑2026‑13713, a use‑after‑free and double‑free vulnerability in YAML::Syck before 1.47 for Perl, and links to vulnerability details and alert subscriptions.

Infoflowcloud@infoflowcloudDisclosure

The post discloses CVE‑2026‑13713, providing technical details of the use‑after‑free and double‑free flaw, but offers no PoC, exploit, patch, or active exploitation evidence.

CVE@CVEnewDisclosure

CVE-2026-13713 is disclosed as a use‑after‑free and double‑free flaw in YAML::Syck before version 1.47, with no PoC, exploit code, or evidence of active exploitation mentioned.