CVE-2026-57076Disclosure

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor. In the bundled libsyck an anchor name allocated by syck_strndup is stored both as node->anchor, freed when the node is freed, and as the key in the parser's anchors table. Freeing the node frees the shared key, and a later anchor redefinition makes st_delete compare against the freed key, so st_strcmp reads freed heap memory. Anchors are a standard YAML feature and need no special flags, so this is reached on the default Load path. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor reaches the read of freed memory.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 3d ago at 2 mentions (2026-07-16); latest day: 1
5 total mentions across 4 days

Deep dive

Activity timeline5 mentions / 4d

Signal classification3 categories

Disclosure

360.0%

General

120.0%

Patch

120.0%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-16	2	Disclosure2
2026-07-17	1	Disclosure1
2026-07-19	1	General1
2026-07-20	1	Patch1

Full discourse5 posts

Open Source Security mailing list@oss_security89d
General
Perl CPAN YAML::Syck before 1.47 CVE-2026-13713: Use-after-free and double-free https://www.openwall.com/lists/oss-security/2026/07/17/1 CVE-2026-57075: Out-of-bounds read https://www.openwall.com/lists/oss-security/2026/07/17/2 CVE-2026-57076: Use-after-free https://www.openwall.com/lists/oss-security/2026/07/17/3 CVE-2026-57077: Out-of-bounds read https://www.openwall.com/lists/oss-security/2026/07/17/4
Post summary
The post lists several CVEs affecting Perl CPAN YAML::Syck with brief vulnerability type descriptions but provides no PoC, exploit code, patches, or evidence of active exploitation.
1000064
4.7K followersView on X
VulniPulse@vulnipulse88d
Patch
⚠️ Red Hat Enterprise Linux 6 alert: CVE-2026-57076 (CVSS 6.3) Attackers could access sensitive information. Apply the vendor-recommended mitigation. https://vulnipulse.com/advisories/linux-cve-2026-57076 #Linux #RedHatEnterpriseLinux6 #CyberSecurity #CVE
Post summary
Red Hat Enterprise Linux 6 is affected by CVE‑2026‑57076, which could allow attackers to access sensitive data; the vendor has issued a recommended patch and accompanying mitigation.
0000030
6 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-57076 Heap Use-After-Free in YAML::Syck Perl Module via Anchor Name Reuse https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-57076
Post summary
This post announces CVE-2026-57076, a heap use‑after‑free vulnerability in the YAML::Syck Perl module caused by anchor name reuse, and links to a detailed vulnerability page.
0000099
4.1K followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-57076 YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor. In the bundled libsyc… https://www.cve.org/CVERecord?id=CVE-2026-57076 ----- Traducción: CVE-2026-57076 YAM… http://infoflow.cloud`
Post summary
The post announces a heap use‑after‑free vulnerability in YAML::Syck <1.47 for Perl, citing CVE‑2026‑57076 and providing a reference link.
0000032
92 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-57076 YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor. In the bundled libsyc… https://www.cve.org/CVERecord?id=CVE-2026-57076
Post summary
CVE‑2026‑57076 describes a heap use‑after‑free in YAML::Syck <1.47 caused by anchor reuse, but provides no patch, PoC, or evidence of active exploitation.
00000688
57.8K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-57076

VulniPulse[verified]@vulnipulsePatch

Red Hat Enterprise Linux 6 is affected by CVE‑2026‑57076, which could allow attackers to access sensitive data; the vendor has issued a recommended patch and accompanying mitigation.

Open Source Security mailing list@oss_securityGeneral

The post lists several CVEs affecting Perl CPAN YAML::Syck with brief vulnerability type descriptions but provides no PoC, exploit code, patches, or evidence of active exploitation.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

This post announces CVE-2026-57076, a heap use‑after‑free vulnerability in the YAML::Syck Perl module caused by anchor name reuse, and links to a detailed vulnerability page.

Infoflowcloud@infoflowcloudDisclosure

The post announces a heap use‑after‑free vulnerability in YAML::Syck <1.47 for Perl, citing CVE‑2026‑57076 and providing a reference link.

CVE@CVEnewDisclosure

CVE‑2026‑57076 describes a heap use‑after‑free in YAML::Syck <1.47 caused by anchor reuse, but provides no patch, PoC, or evidence of active exploitation.