CVE-2026-13713 describes a use-after-free and double-free vulnerability in YAML::Syck versions before 1.47. The issue arises in the bundled libsyck library when an anchor node is freed while still present on the parser's value stack. Specifically, when an anchor name is redefined or removed, the associated node is freed, but the parser may still reference it and attempt to free it again, causing a double free. This leads to interpreter aborts and denial of service. The vulnerability is triggered by loading YAML documents that redefine anchors during parsing, which requires no special flags and can be reached via the default Load path.

Successful exploitation causes the Perl interpreter using YAML::Syck to crash, resulting in a denial of service. There is no indication of confidentiality or integrity impact. The vulnerability affects availability only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid loading untrusted YAML documents that redefine anchors mid-parse to prevent interpreter crashes.