Red Hat Security Advisory

RHSA-2026:93471

perl-YAML:1.24 security update

Released 2026-11-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) perl-YAML-1.24-4.module+el8.10.0+25073+42d87e53.noarch::perl-YAML:1.24, perl-YAML-1.24-4.module+el8.10.0+25073+42d87e53.src::perl-YAML:1.24, perl-YAML-1.24-4.module+el8.10.0+25073+d1062575.noarch::perl-YAML:1.24 +1

TI-2017-14763 CVE-2017-20285 · GHSA-c454-fc94-q86x

MEDIUM 47

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0034 Published 2026-10-05 Partial fix · 1.30 CWE-470

TI-2019-16191 CVE-2019-25777 · GHSA-38xx-2hm6-vh7q

LOW 38

YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00352 Published 2026-10-05 Partial fix · 1.27_001 CWE-502