{"id":"AZL-109514","summary":"CVE-2025-11683 affecting package perl-YAML 1.30-2","details":"YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure\n\nMissing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read\n\nThe issue is seen with complex YAML files with a hash of all keys and empty values.  There is no indication that the issue leads to accessing memory outside that allocated to the module.","modified":"2026-10-22T05:35:55Z","published":"2025-10-16T01:15:32Z","upstream":["CVE-2025-11683"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11683"}],"affected":[{"package":{"name":"perl-YAML","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/perl-YAML"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30-2"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109514.json"}}],"schema_version":"1.9.0"}