| Name | CVE-2026-75432 |
| Description | An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and Scanner::PushIndentTo() components |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| yaml-cpp (PTS) | bookworm | 0.7.0+dfsg-8 | fixed |
| trixie | 0.8.0+dfsg-7 | fixed |
| forky, sid | 0.9.0+dfsg-9 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| yaml-cpp | source | (unstable) | (not affected) | | | |
Notes
- yaml-cpp <not-affected> (Vulnerable code introduced later, cf. bug #1149048)
https://github.com/jbeder/yaml-cpp/issues/1475
https://github.com/jbeder/yaml-cpp/pull/1476
Introduced with: https://github.com/jbeder/yaml-cpp/commit/c7a86c0e1f4868abebab474a6a3e19cf27ebfaac
Fixed by: https://github.com/jbeder/yaml-cpp/commit/8b2e6ba3288de15ed7a61d5c89cde2ed47327c1e