[Git][security-tracker-team/security-tracker][master] Add CVE-2026-88359/libfyaml

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b51da5da by Salvatore Bonaccorso at 2026-09-25T11:00:32+02:00
Add CVE-2026-88359/libfyaml

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -291,7 +291,9 @@ CVE-2026-88360 (libvips 8.19.0 contains a memory access vulnerability when proce
 	- vips <unfixed>
 	NOTE: https://github.com/libvips/libvips/issues/5187
 CVE-2026-88359 (libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_it ...)
-	TODO: check
+	- libfyaml <unfixed>
+	NOTE: https://github.com/pantoniou/libfyaml/issues/315
+	NOTE: Fixed by: https://github.com/pantoniou/libfyaml/commit/12d903a5c9163d15edf2ef9d7311bd0d1505d902 (v1.0.0-beta1)
 CVE-2026-88358 (simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in ...)
 	TODO: check
 CVE-2026-88357 (nDPI 5.1.0 contains a memory access issue in the DNS dissector and ser ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b51da5dab6948f035d354fa910a9b7da5f482869

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b51da5dab6948f035d354fa910a9b7da5f482869
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260925/2a3e512e/attachment.htm>