YAML-Syck project reports:
YAML-Syck 1.47 fix the following issues:
- CVE-2026-57075 (CWE-125): out-of-bounds read in the base64 decoder
caused by signed-char indexing of the decode table on !!binary input
- CVE-2026-57076 (CWE-416): use-after-free of an anchor key string
shared between the node and the anchors table
- CVE-2026-57077 (CWE-125): one-byte out-of-bounds read in the lexer
newline scan during block-scalar parsing (incomplete-fix follow-on
to CVE-2025-11683)
- CVE-2026-13713 (CWE-416/CWE-415): use-after-free / double-free of an
anchor node on anchor redefinition, a remote-crash DoS from a
7-byte input