CVE-2026-88359

Name	CVE-2026-88359
Description	libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a very large literal or folded block scalar, the function repeatedly grows an internal buffer using alloca() inside a loop. The allocated stack memory is not released until the function returns, causing cumulative stack growth that can exceed the process stack limit and result in SIGSEGV and denial of service.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1149055

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libfyaml (PTS)	bookworm	0.7.12-2	vulnerable
	trixie	0.8-1	vulnerable
	forky, sid	0.9.4-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libfyaml	source	(unstable)	(unfixed)			1149055

Notes

[trixie] - libfyaml <no-dsa> (Minor issue)
[bookworm] - libfyaml <postponed> (Minor issue)
https://github.com/pantoniou/libfyaml/issues/315
Fixed by: https://github.com/pantoniou/libfyaml/commit/12d903a5c9163d15edf2ef9d7311bd0d1505d902 (v1.0.0-beta1)