yaml/libyaml

CVE-2024-35326

frenzymadness opened this issue · 1 comments

frenzymadness commented

There is a new security vulnerability report with ID CVE-2024-35326

The reproducer is available here: https://github.com/idhyt/pocs/blob/main/libyaml/CVE-2024-35326.c

Could please anybody, who understands the codebase of libyaml, verify that this is really an issue/vulnerability? Previous experiences teach us that not all CVEs are really something to fix here.

perlpunk commented

I now created #302 for the three similar CVEs and will close this one.
Btw, I already wrote in #298 that I don't consider those a vulnerability.