{"id":"AZL-109466","summary":"CVE-2025-11683 affecting package perl-YAML-Syck 1.34-1","details":"YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure\n\nMissing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read\n\nThe issue is seen with complex YAML files with a hash of all keys and empty values.  There is no indication that the issue leads to accessing memory outside that allocated to the module.","modified":"2026-10-22T05:37:13Z","published":"2025-10-16T01:15:32Z","upstream":["CVE-2025-11683"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11683"}],"affected":[{"package":{"name":"perl-YAML-Syck","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/perl-YAML-Syck"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.34-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109466.json"}}],"schema_version":"1.9.0"}