{"id":"CVE-2026-88359","details":"libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a very large literal or folded block scalar, the function repeatedly grows an internal buffer using alloca() inside a loop. The allocated stack memory is not released until the function returns, causing cumulative stack growth that can exceed the process stack limit and result in SIGSEGV and denial of service.","modified":"2026-09-26T08:10:31.860589Z","published":"2026-09-24T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88359.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88359.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88359"},{"type":"REPORT","url":"https://github.com/pantoniou/libfyaml/issues/315"},{"type":"FIX","url":"https://github.com/pantoniou/libfyaml/commit/20502068902d58c076da873117985798df2c7e74"},{"type":"FIX","url":"https://github.com/pantoniou/libfyaml/commit/93741a7c9331da9da65ef7a25f2d7d6a817a1c29"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pantoniou/libfyaml","events":[{"introduced":"0"},{"fixed":"20502068902d58c076da873117985798df2c7e74"},{"fixed":"93741a7c9331da9da65ef7a25f2d7d6a817a1c29"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88359.json","vanir_signatures_modified":"2026-09-26T08:10:31Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["61920812842142106563589406103997911782","62758241498136991755043246691830646345","286303203282737500274075590952459086833","139652499343068243873325109410733409721","119936839941689989767910172004759128927","229994977989517286851560993542641318089","74837165686115095640156949666609274966","103522124555610774360875825662129410067","221500566923911724618580933002163024707","138303113161331470688059583109996186192","157792201275096650261848279014401794320","226407338055486891124061245679676492716","76499667696467868168983696537475628527","130626575065549292081482454621469070543","50554678929542106997947882792359144521","253933515390850235535664809035440082622","154037992605074393814416723709180935741","162892554455575159230507978351353313756","223736103470233490276467219112402353187","59818622632532588891106063255729758562","280673450353424224153249736289431486377"],"threshold":0.9},"id":"CVE-2026-88359-0275c3c1","signature_type":"Line","signature_version":"v1","source":"https://github.com/pantoniou/libfyaml/commit/93741a7c9331da9da65ef7a25f2d7d6a817a1c29","target":{"file":"src/lib/fy-atom.c"}},{"signature_version":"v1","source":"https://github.com/pantoniou/libfyaml/commit/20502068902d58c076da873117985798df2c7e74","target":{"file":"test/libfyaml-test-core.c","function":"libfyaml_case_core"},"deprecated":false,"digest":{"function_hash":"231768591150517029722199040096750167751","length":2604},"id":"CVE-2026-88359-1ec349a7","signature_type":"Function"},{"source":"https://github.com/pantoniou/libfyaml/commit/20502068902d58c076da873117985798df2c7e74","target":{"file":"src/lib/fy-atom.c"},"deprecated":false,"digest":{"line_hashes":["61920812842142106563589406103997911782","62758241498136991755043246691830646345","286303203282737500274075590952459086833","139652499343068243873325109410733409721","119936839941689989767910172004759128927","229994977989517286851560993542641318089","74837165686115095640156949666609274966","103522124555610774360875825662129410067","221500566923911724618580933002163024707","138303113161331470688059583109996186192","157792201275096650261848279014401794320","226407338055486891124061245679676492716","76499667696467868168983696537475628527","130626575065549292081482454621469070543","50554678929542106997947882792359144521","253933515390850235535664809035440082622","154037992605074393814416723709180935741","162892554455575159230507978351353313756","223736103470233490276467219112402353187","59818622632532588891106063255729758562","280673450353424224153249736289431486377"],"threshold":0.9},"id":"CVE-2026-88359-36c449c0","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["71564149890603400451156813052227741751","53696754506217328055391814302192124820","156224012742373045626489304120893551750","53723976484604256511246959919482284151","309920046610189663292338629540440570898","62789467552828838019151654624791992325","212048662667338543489947920187743665952"],"threshold":0.9},"id":"CVE-2026-88359-389c4557","signature_type":"Line","signature_version":"v1","source":"https://github.com/pantoniou/libfyaml/commit/20502068902d58c076da873117985798df2c7e74","target":{"file":"test/libfyaml-test-core.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"59001287525567600848867549252359140530","length":5195},"id":"CVE-2026-88359-546115e8","signature_type":"Function","signature_version":"v1","source":"https://github.com/pantoniou/libfyaml/commit/93741a7c9331da9da65ef7a25f2d7d6a817a1c29","target":{"file":"src/lib/fy-atom.c","function":"fy_atom_iter_format"}},{"deprecated":false,"digest":{"line_hashes":["71564149890603400451156813052227741751","53696754506217328055391814302192124820","156224012742373045626489304120893551750","53723976484604256511246959919482284151","309920046610189663292338629540440570898","62789467552828838019151654624791992325","212048662667338543489947920187743665952"],"threshold":0.9},"id":"CVE-2026-88359-69b02fd3","signature_type":"Line","signature_version":"v1","source":"https://github.com/pantoniou/libfyaml/commit/93741a7c9331da9da65ef7a25f2d7d6a817a1c29","target":{"file":"test/libfyaml-test-core.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/pantoniou/libfyaml/commit/20502068902d58c076da873117985798df2c7e74","target":{"file":"src/lib/fy-atom.c","function":"fy_atom_iter_format"},"deprecated":false,"digest":{"function_hash":"59001287525567600848867549252359140530","length":5195},"id":"CVE-2026-88359-86188374"},{"deprecated":false,"digest":{"function_hash":"231768591150517029722199040096750167751","length":2604},"id":"CVE-2026-88359-eae865d1","signature_type":"Function","signature_version":"v1","source":"https://github.com/pantoniou/libfyaml/commit/93741a7c9331da9da65ef7a25f2d7d6a817a1c29","target":{"file":"test/libfyaml-test-core.c","function":"libfyaml_case_core"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}