CVE-2025-11683: YAML::Syck versions before 1.36 for Perl has missing Null-Terminators which causes Out-of-Bounds Read and potential Information Disclosure

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-16 · updated 2026-10-08
Weakness: CWE-119

Description

YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read The issue is seen with complex YAML files with a hash of all keys and empty values. There is no indication that the issue leads to accessing memory outside that allocated to the module.

Affected products

TODDR Yaml::Syck: before 1.36 — fixed in 1.36

How to fix

Upgrade to a fixed version: TODDR Yaml::Syck 1.36. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-11683 or the next vulnerability affects your stack