ZeroDay Findings
Sign inSign up

Findings

USN-8925-1

libyaml-perl vulnerabilities

Published Oct 14, 2026 · updated Oct 14, 2026

Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection operations. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-20285) It was discovered that YAML-LibYAML did not correctly handle parsing certain documents. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-25777) It was discovered that YAML-LibYAML contained a regular expression susceptible to catastrophic backtracking. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. (CVE-2026-63676)

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · OSV.dev

    Detected

    Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection operations. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-20285) It was discovered that YAML-LibYAML did not correctly handle parsing certain documents

  2. Oct 14, 2026 · OSV.dev

    Fix available

    libyaml-perl fixed in 1.15-1ubuntu0.1~esm1; libyaml-perl fixed in 1.24-1ubuntu0.1~esm1; libyaml-perl fixed in 1.30-1ubuntu0.20.04.1~esm1; libyaml-perl fixed in 1.30-1ubuntu0.22.04.1

  3. Oct 14, 2026 · OSV.dev

    Fix available

    libyaml-perl fixed in 1.15-1ubuntu0.1~esm1

  4. Oct 14, 2026 · OSV.dev

    Fix available

    libyaml-perl fixed in 1.24-1ubuntu0.1~esm1

  5. Oct 14, 2026 · OSV.dev

    Fix available

    libyaml-perl fixed in 1.30-1ubuntu0.20.04.1~esm1

  6. Oct 14, 2026 · OSV.dev

    Fix available

    libyaml-perl fixed in 1.30-1ubuntu0.22.04.1

  7. Oct 14, 2026 · OSV.dev

    Fix available

    libyaml-perl fixed in 1.31-1ubuntu0.24.04.1

  8. Oct 14, 2026 · OSV.dev

    Fix available

    libyaml-perl fixed in 1.31-1ubuntu0.26.04.1~esm1

  9. Oct 14, 2026 · OSV.dev

    Updated

    Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection operations. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-20285) It was discovered that YAML-LibYAML did not correctly handle parsing certain documents

Affected

  • Ubuntu:22.04:LTS libyaml-perl0 → 1.30-1ubuntu0.22.04.1
  • Ubuntu:24.04:LTS libyaml-perl0 → 1.31-1ubuntu0.24.04.1
  • Ubuntu:Pro:16.04:LTS libyaml-perl0 → 1.15-1ubuntu0.1~esm1
  • Ubuntu:Pro:18.04:LTS libyaml-perl0 → 1.24-1ubuntu0.1~esm1
  • Ubuntu:Pro:20.04:LTS libyaml-perl0 → 1.30-1ubuntu0.20.04.1~esm1
  • Ubuntu:Pro:26.04:LTS libyaml-perl0 → 1.31-1ubuntu0.26.04.1~esm1

Sources

References