Hi Simon, > Control: notfound -1 0.9.0+dfsg-9 > > Hi Salvatore, > > Please mark yaml-cpp <not-affected> for bookworm, trixie, and sid. > No upload is planned. > > The crash is an empty indent-stack pop in Scanner::PopIndent(). > Upstream introduced it in c7a86c0 (PR #1468, 2026-07-30), *after* > the yaml-cpp-0.9.0 tag (56e3bb5, 2026-02-04). That commit is not in > the 0.9.0 tarball. > > I ran the public inputs against the archive versions: > > bookworm 0.7.0+dfsg-8+b1 ParserException (the 96-byte sample parses) > trixie 0.8.0+dfsg-7 ParserException > sid 0.9.0+dfsg-9 ParserException > > None of them abort. Those inputs do abort on upstream 3eb39d5, which > is after #1468 and before #1476: UndefinedBehaviorSanitizer in > PopIndent(), and SIGSEGV. > > The MITRE text describes an information leak in 0.9.0. What > reproduces is a crash on master snapshots from 30 July to 10 August > 2026. No Debian suite is in that window. > > Please let me know if you have any questions, or if this still needs > to be fixed after all.
Yes, agreed, the issue is introduced with https://github.com/jbeder/yaml-cpp/commit/c7a86c0e1f4868abebab474a6a3e19cf27ebfaac , so I have updated the tracker information on the CVE. Regards, Salvatore
