CVE-2026-88359CWE-770denial-of-service

CVE-2026-88359

Medium · published September 24, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a very large literal or folded block scalar, the function repeatedly grows an internal buffer using alloca() inside a loop. The allocated stack memory is not released until the function returns, causing cumulative stack growth that can exceed the process stack limit and result in SIGSEGV and denial of service.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00247 · 15.1th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-24T18:18Z
References (4)
https://github.com/pantoniou/libfyaml/commit/20502068902d58c076da873117985798df2c7e74 · [email protected]https://github.com/pantoniou/libfyaml/commit/93741a7c9331da9da65ef7a25f2d7d6a817a1c29 · [email protected]https://github.com/pantoniou/libfyaml/issues/315 · [email protected]https://github.com/pantoniou/libfyaml/issues/315 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 24 SEP 00:00Z
    libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format()
    cvelistv5