YAML::Syck versions up to 1.36 for Perl contain multiple security vulnerabilities, notably a high-severity heap buffer overflow triggered when class names exceed a 512-byte buffer allocation during YAML emission. Other vulnerabilities include a base64 decoder that may read beyond buffer boundaries on trailing newlines, in-place mutation of node type IDs corrupting shared data, and a memory leak in the anchor handling function when duplicate anchors are added. These issues can lead to denial of service or potential memory corruption. Red Hat has released security updates for their Extended Life Cycle Support 7 distributions to address these flaws.

The heap buffer overflow vulnerability can lead to application crashes or potentially arbitrary code execution due to memory corruption. The base64 decoder flaw and strtok mutation can cause data corruption or instability. The memory leak may degrade system performance over time. The CVSS score of 9.1 indicates critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and availability.

Red Hat has released official security updates for perl-YAML-Syck in Red Hat Enterprise Linux 7 Extended Life Cycle Support to fix these vulnerabilities. Users should apply these updates promptly. The vendor advisory does not indicate that no action is required or that the issue is already mitigated without updates. Patch status is confirmed by Red Hat advisories RHSA-2026:6470 and RHSA-2026:8311. No cloud service is involved; remediation requires applying vendor patches.