CVE-2026-13713

Name of the Vulnerable Software and Affected Versions YAML::Syck versions prior to 1.47

Description An issue exists where a use-after-free and double-free occur via an anchor node that is freed while remaining on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, the functions syck hdlr add anchor() and syck hdlr remove anchor() free the node stored under that name using syck free node(). Because that node can still be live on the parser's value stack, syck hdlr add node() may access and free it a second time. This can be triggered by a document that redefines an anchor during the default Load path, causing the interpreter to abort and resulting in a denial of service for any caller running Load() or LoadFile() on an untrusted document.

Recommendations Update to version 1.47 or later.