CVE-2026-57077Disclosure

LOWCVSS 7.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover. Any caller that runs Load or LoadFile on an untrusted document with a block scalar at a document boundary reaches the over-read.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-125

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 3d ago at 2 mentions (2026-07-16); latest day: 1
5 total mentions across 4 days

Deep dive

Activity timeline5 mentions / 4d

Signal classification3 categories

Disclosure

360.0%

General

120.0%

Patch

120.0%

Referenced assets9 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-16	2	Disclosure2
2026-07-17	1	General1
2026-07-19	1	Disclosure1
2026-07-20	1	Patch1

Full discourse5 posts

Open Source Security mailing list@oss_security90d
Disclosure
Perl CPAN YAML::Syck before 1.47 CVE-2026-13713: Use-after-free and double-free https://www.openwall.com/lists/oss-security/2026/07/17/1 CVE-2026-57075: Out-of-bounds read https://www.openwall.com/lists/oss-security/2026/07/17/2 CVE-2026-57076: Use-after-free https://www.openwall.com/lists/oss-security/2026/07/17/3 CVE-2026-57077: Out-of-bounds read https://www.openwall.com/lists/oss-security/2026/07/17/4
Post summary
The text lists several newly disclosed Perl CPAN YAML::Syck vulnerabilities, providing CVE identifiers, brief type descriptions (e.g., use-after-free, out-of-bounds read), and supporting links to OpenWall discussions.
1000064
4.7K followersView on X
VulniPulse@vulnipulse89d
Patch
⚠️ Red Hat Enterprise Linux 6 alert: CVE-2026-57077 (CVSS 4.3) Remote attackers could access sensitive information. Apply the vendor-recommended mitigation. https://vulnipulse.com/advisories/linux-cve-2026-57077 #Linux #RedHatEnterpriseLinux6 #CyberSecurity #CVE
Post summary
The post announces a Red Hat Enterprise Linux 6 advisory (CVE‑2026‑57077) and urges users to apply the vendor‑recommended mitigation, providing a CVSS score and a brief description of the vulnerability.
0000031
6 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds92d
General
CVE-2026-57077 Out-of-Bounds Read in YAML::Syck Before 1.47 via Unbounded Newlin... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-57077 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The tweet announces CVE-2026-57077 as an out‑of‑bounds read in YAML::Syck, providing a link to a detailed page but offering no PoC, exploit code, patch, or evidence of active exploitation.
0000088
4.1K followersView on X
Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-57077 YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline … https://www.cve.org/CVERecord?id=CVE-2026-57077 ----- Traducción: CVE-2026-57077 YAM… http://infoflow.cloud`
Post summary
The post announces CVE-2026-57077, detailing an out‑of‑bounds read in YAML::Syck before version 1.47, but provides no PoC, exploit code, patch, or evidence of active exploitation.
0000032
92 followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-57077 YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline … https://www.cve.org/CVERecord?id=CVE-2026-57077
Post summary
The post announces CVE‑2026‑57077, noting an out‑of‑bounds read in YAML::Syck before version 1.47, but contains no PoC, exploit code, patch, or evidence of active exploitation.
00000723
57.8K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-57077

VulniPulse[verified]@vulnipulsePatch

The post announces a Red Hat Enterprise Linux 6 advisory (CVE‑2026‑57077) and urges users to apply the vendor‑recommended mitigation, providing a CVSS score and a brief description of the vulnerability.

Open Source Security mailing list@oss_securityDisclosure

The text lists several newly disclosed Perl CPAN YAML::Syck vulnerabilities, providing CVE identifiers, brief type descriptions (e.g., use-after-free, out-of-bounds read), and supporting links to OpenWall discussions.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The tweet announces CVE-2026-57077 as an out‑of‑bounds read in YAML::Syck, providing a link to a detailed page but offering no PoC, exploit code, patch, or evidence of active exploitation.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE-2026-57077, detailing an out‑of‑bounds read in YAML::Syck before version 1.47, but provides no PoC, exploit code, patch, or evidence of active exploitation.

CVE@CVEnewDisclosure

The post announces CVE‑2026‑57077, noting an out‑of‑bounds read in YAML::Syck before version 1.47, but contains no PoC, exploit code, patch, or evidence of active exploitation.