CVE-2026-13713

{"id": "CVE-2026-13713", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13713", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T13:17:36.382946Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/toddr/YAML-Syck", "vendor": "TODDR", "product": "YAML::Syck", "versions": [{"status": "affected", "version": "0", "lessThan": "1.47", "versionType": "custom"}], "packageName": "YAML-Syck", "programFiles": ["handler.c", "syck_.c", "syck.h"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "syck_hdlr_add_anchor"}, {"name": "syck_hdlr_remove_anchor"}, {"name": "syck_hdlr_add_node"}]}]}], "published": "2026-07-16T22:16:59.640", "references": [{"url": "https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/17/1", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-415"}, {"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.\n\nIn the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.\n\nAny caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service."}, {"lang": "es", "value": "Las versiones de YAML::Syck anteriores a la 1.47 para Perl permiten un uso despu\u00e9s de liberaci\u00f3n y una doble liberaci\u00f3n a trav\u00e9s de un nodo ancla liberado mientras a\u00fan est\u00e1 en la pila de valores del analizador.\n\nEn la libsyck incluida, cuando un nombre de ancla es redefinido o eliminado, syck_hdlr_add_anchor y syck_hdlr_remove_anchor liberan el nodo almacenado bajo ese nombre con syck_free_node. Ese nodo a\u00fan puede estar activo en la pila de valores del analizador, por lo que syck_hdlr_add_node lo alcanza de nuevo y lo libera una segunda vez. En una compilaci\u00f3n normal, el fragmento de nodo de 48 bytes es liberado dos veces y el int\u00e9rprete aborta. Los anclas no necesitan banderas especiales, por lo que esto se alcanza en la ruta de carga (Load) predeterminada, y un documento de 7 bytes que redefine un ancla lo activa.\n\nCualquier llamador que ejecute Load o LoadFile en un documento no confiable que redefine un ancla a mitad del an\u00e1lisis bloquea el int\u00e9rprete, una denegaci\u00f3n de servicio."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}