Backport upstream commit 44c90a10 to fix four libsyck
memory-safety CVEs reachable from YAML::Syck::Load() on
untrusted input:
- CVE-2026-57075: out-of-bounds read in base64 decoder
- CVE-2026-57076: use-after-free of anchor key string
- CVE-2026-57077: out-of-bounds read in lexer newline scan
- CVE-2026-13713: use-after-free / double-free of anchor node
The patch includes per-CVE regression tests under t/cve-*.t.
CVE: CVE-2026-13713
Upstream patches:
- 44c90a109e.patch
Resolves: RHEL-211926
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
