CVE-2026-88359

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-88359

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88359.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-88359

Downstream

Published

2026-09-24T00:00:00Z

Modified

2026-09-27T08:02:59Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a very large literal or folded block scalar, the function repeatedly grows an internal buffer using alloca() inside a loop. The allocated stack memory is not released until the function returns, causing cumulative stack growth that can exceed the process stack limit and result in SIGSEGV and denial of service.

Database specific

{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88359.json"
}

References

Affected packages

Git / github.com/pantoniou/libfyaml

Affected ranges

Type

GIT

Repo

https://github.com/pantoniou/libfyaml

Events

Introduced

Fixed

20502068902d58c076da873117985798df2c7e74

Fixed

93741a7c9331da9da65ef7a25f2d7d6a817a1c29

Database specific

Show details

{
    "source":  "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88359.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "61920812842142106563589406103997911782",
                "62758241498136991755043246691830646345",
                "286303203282737500274075590952459086833",
                "139652499343068243873325109410733409721",
                "119936839941689989767910172004759128927",
                "229994977989517286851560993542641318089",
                "74837165686115095640156949666609274966",
                "103522124555610774360875825662129410067",
                "221500566923911724618580933002163024707",
                "138303113161331470688059583109996186192",
                "157792201275096650261848279014401794320",
                "226407338055486891124061245679676492716",
                "76499667696467868168983696537475628527",
                "130626575065549292081482454621469070543",
                "50554678929542106997947882792359144521",
                "253933515390850235535664809035440082622",
                "154037992605074393814416723709180935741",
                "162892554455575159230507978351353313756",
                "223736103470233490276467219112402353187",
                "59818622632532588891106063255729758562",
                "280673450353424224153249736289431486377"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88359-0275c3c1",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pantoniou/libfyaml/commit/93741a7c9331da9da65ef7a25f2d7d6a817a1c29",
        "target":  {
            "file":  "src/lib/fy-atom.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "231768591150517029722199040096750167751",
            "length":  2604
        },
        "id":  "CVE-2026-88359-1ec349a7",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/pantoniou/libfyaml/commit/20502068902d58c076da873117985798df2c7e74",
        "target":  {
            "file":  "test/libfyaml-test-core.c",
            "function":  "libfyaml_case_core"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "61920812842142106563589406103997911782",
                "62758241498136991755043246691830646345",
                "286303203282737500274075590952459086833",
                "139652499343068243873325109410733409721",
                "119936839941689989767910172004759128927",
                "229994977989517286851560993542641318089",
                "74837165686115095640156949666609274966",
                "103522124555610774360875825662129410067",
                "221500566923911724618580933002163024707",
                "138303113161331470688059583109996186192",
                "157792201275096650261848279014401794320",
                "226407338055486891124061245679676492716",
                "76499667696467868168983696537475628527",
                "130626575065549292081482454621469070543",
                "50554678929542106997947882792359144521",
                "253933515390850235535664809035440082622",
                "154037992605074393814416723709180935741",
                "162892554455575159230507978351353313756",
                "223736103470233490276467219112402353187",
                "59818622632532588891106063255729758562",
                "280673450353424224153249736289431486377"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88359-36c449c0",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pantoniou/libfyaml/commit/20502068902d58c076da873117985798df2c7e74",
        "target":  {
            "file":  "src/lib/fy-atom.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "71564149890603400451156813052227741751",
                "53696754506217328055391814302192124820",
                "156224012742373045626489304120893551750",
                "53723976484604256511246959919482284151",
                "309920046610189663292338629540440570898",
                "62789467552828838019151654624791992325",
                "212048662667338543489947920187743665952"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88359-389c4557",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pantoniou/libfyaml/commit/20502068902d58c076da873117985798df2c7e74",
        "target":  {
            "file":  "test/libfyaml-test-core.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "59001287525567600848867549252359140530",
            "length":  5195
        },
        "id":  "CVE-2026-88359-546115e8",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/pantoniou/libfyaml/commit/93741a7c9331da9da65ef7a25f2d7d6a817a1c29",
        "target":  {
            "file":  "src/lib/fy-atom.c",
            "function":  "fy_atom_iter_format"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "71564149890603400451156813052227741751",
                "53696754506217328055391814302192124820",
                "156224012742373045626489304120893551750",
                "53723976484604256511246959919482284151",
                "309920046610189663292338629540440570898",
                "62789467552828838019151654624791992325",
                "212048662667338543489947920187743665952"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88359-69b02fd3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pantoniou/libfyaml/commit/93741a7c9331da9da65ef7a25f2d7d6a817a1c29",
        "target":  {
            "file":  "test/libfyaml-test-core.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "59001287525567600848867549252359140530",
            "length":  5195
        },
        "id":  "CVE-2026-88359-86188374",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/pantoniou/libfyaml/commit/20502068902d58c076da873117985798df2c7e74",
        "target":  {
            "file":  "src/lib/fy-atom.c",
            "function":  "fy_atom_iter_format"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "231768591150517029722199040096750167751",
            "length":  2604
        },
        "id":  "CVE-2026-88359-eae865d1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/pantoniou/libfyaml/commit/93741a7c9331da9da65ef7a25f2d7d6a817a1c29",
        "target":  {
            "file":  "test/libfyaml-test-core.c",
            "function":  "libfyaml_case_core"
        }
    }
]

vanir_signatures_modified

"2026-09-27T08:02:59Z"