# CVE-2026-13713: libyaml-syck-perl: YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still...

CVE-2026-13713 is fixed in 5 products on 1 platform, first by FEDORA-2026-C8484F1AFB, released July 14, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-13713
- Priority: High
- CVSS: 7.5 (medium)
- EPSS: 0.0018
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 14, 2026

## Description

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack.  In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it.  Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libyaml-syck-perl Debian 12.15 (bookworm) | 1.34-2+deb12u3 | [DEBIAN-CVE-2026-13713](https://patchblox.com/security/data/fix/linux/debian-cve-2026-13713.md) | Jul 19, 2026 |
| Linux | libyaml-syck-perl Debian 13.5 (trixie) | 1.34-2+deb13u3 | [DEBIAN-CVE-2026-13713](https://patchblox.com/security/data/fix/linux/debian-cve-2026-13713.md) | Jul 19, 2026 |
| Linux | libyaml-syck-perl Debian 14 | 1.47-1 | [DEBIAN-CVE-2026-13713](https://patchblox.com/security/data/fix/linux/debian-cve-2026-13713.md) | Jul 19, 2026 |
| Linux | perl-YAML-Syck Fedora 43 | 1.47-1.fc43 | [FEDORA-2026-C8484F1AFB](https://patchblox.com/security/data/fix/linux/fedora-2026-c8484f1afb.md) | Jul 14, 2026 |
| Linux | perl-YAML-Syck RHEL 8 | 0:1.30-7.el8_10 | [RHSA-2026:67269](https://patchblox.com/security/data/fix/linux/rhsa-2026-67269.md) | Sep 19, 2026 |
| Linux | perl-YAML-Syck almalinux 8 | 1.30-7.el8_10 | [ALSA-2026:67269](https://patchblox.com/security/data/fix/linux/alsa-2026-67269.md) | Sep 14, 2026 |
| Linux | perl-YAML-Syck amzn 2023 | 1.37-1.amzn2023.0.4 | [ALAS2023-2026-2007](https://patchblox.com/security/data/fix/linux/alas2023-2026-2007.md) | Aug 3, 2026 |
| Linux | perl-YAML-Syck ol 8 | 0:1.30-7.el8_10 | [ELSA-2026-67269-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67269-0.md) | Sep 14, 2026 |
| Linux | perl-YAML-Syck opensuse-leap 16.0 | 1.470.0-bp160.1.1 | [OPENSUSE-SU-2026:21497-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21497-1.md) | Jul 29, 2026 |
| Linux | perl-YAML-Syck rocky 8 | 0:1.30-7.el8_10 | [RLSA-2026:67269](https://patchblox.com/security/data/fix/linux/rlsa-2026-67269.md) | Sep 15, 2026 |
| Linux | perl-YAML-Syck-debuginfo Fedora 43 | 1.47-1.fc43 | [FEDORA-2026-C8484F1AFB](https://patchblox.com/security/data/fix/linux/fedora-2026-c8484f1afb.md) | Jul 14, 2026 |
| Linux | perl-YAML-Syck-debuginfo amzn 2023 | 1.37-1.amzn2023.0.4 | [ALAS2023-2026-2007](https://patchblox.com/security/data/fix/linux/alas2023-2026-2007.md) | Aug 3, 2026 |
| Linux | perl-YAML-Syck-debugsource Fedora 43 | 1.47-1.fc43 | [FEDORA-2026-C8484F1AFB](https://patchblox.com/security/data/fix/linux/fedora-2026-c8484f1afb.md) | Jul 14, 2026 |
| Linux | perl-YAML-Syck-debugsource amzn 2023 | 1.37-1.amzn2023.0.4 | [ALAS2023-2026-2007](https://patchblox.com/security/data/fix/linux/alas2023-2026-2007.md) | Aug 3, 2026 |
| Linux | perl-YAML-Syck-tests amzn 2023 | 1.37-1.amzn2023.0.4 | [ALAS2023-2026-2007](https://patchblox.com/security/data/fix/linux/alas2023-2026-2007.md) | Aug 3, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.