ZeroDay Findings
Sign inSign up

Findings

USN-8925-1

libyaml-perl vulnerabilities

Published Oct 14, 2026 · updated Oct 14, 2026

Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection operations. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-20285) It was discovered that YAML-LibYAML did not correctly handle parsing certain documents. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-25777) It was discovered that YAML-LibYAML contained a regular expression susceptible to catastrophic backtracking. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. (CVE-2026-63676)

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · OSV.dev

    Detected

    Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection operations. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-20285) It was discovered that YAML-LibYAML did not correctly handle parsing certain documents

  2. Oct 14, 2026 · OSV.dev

    Fix available

    libyaml-perl fixed in 1.15-1ubuntu0.1~esm1; libyaml-perl fixed in 1.24-1ubuntu0.1~esm1; libyaml-perl fixed in 1.30-1ubuntu0.20.04.1~esm1; libyaml-perl fixed in 1.30-1ubuntu0.22.04.1

  3. Oct 14, 2026 · OSV.dev

    Fix available

    libyaml-perl fixed in 1.15-1ubuntu0.1~esm1

  4. Oct 14, 2026 · OSV.dev

    Fix available

    libyaml-perl fixed in 1.24-1ubuntu0.1~esm1

  5. Oct 14, 2026 · OSV.dev

    Fix available

    libyaml-perl fixed in 1.30-1ubuntu0.20.04.1~esm1

  6. Oct 14, 2026 · OSV.dev

    Fix available

    libyaml-perl fixed in 1.30-1ubuntu0.22.04.1

  7. Oct 14, 2026 · OSV.dev

    Fix available

    libyaml-perl fixed in 1.31-1ubuntu0.24.04.1

  8. Oct 14, 2026 · OSV.dev

    Fix available

    libyaml-perl fixed in 1.31-1ubuntu0.26.04.1~esm1

  9. Oct 14, 2026 · OSV.dev

    Updated

    Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection operations. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-20285) It was discovered that YAML-LibYAML did not correctly handle parsing certain documents

Affected

  • Ubuntu:22.04:LTS libyaml-perl0 → 1.30-1ubuntu0.22.04.1
  • Ubuntu:24.04:LTS libyaml-perl0 → 1.31-1ubuntu0.24.04.1
  • Ubuntu:Pro:16.04:LTS libyaml-perl0 → 1.15-1ubuntu0.1~esm1
  • Ubuntu:Pro:18.04:LTS libyaml-perl0 → 1.24-1ubuntu0.1~esm1
  • Ubuntu:Pro:20.04:LTS libyaml-perl0 → 1.30-1ubuntu0.20.04.1~esm1
  • Ubuntu:Pro:26.04:LTS libyaml-perl0 → 1.31-1ubuntu0.26.04.1~esm1

Sources

References