Version in base suite: 1.31-1 Base version: libyaml-perl_1.31-1 Target version: libyaml-perl_1.31-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/liby/libyaml-perl/libyaml-perl_1.31-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/liby/libyaml-perl/libyaml-perl_1.31-1+deb13u1.dsc changelog | 7 ++ patches/fix-Avoid-backtracking-leading-to-exponential-load-t.patch | 27 ++++++++++ patches/series | 1 3 files changed, 35 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmppjcwrvm8/libyaml-perl_1.31-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmppjcwrvm8/libyaml-perl_1.31-1+deb13u1.dsc: no acceptable signature found diff -Nru libyaml-perl-1.31/debian/changelog libyaml-perl-1.31/debian/changelog --- libyaml-perl-1.31/debian/changelog 2024-01-01 02:43:19.000000000 +0000 +++ libyaml-perl-1.31/debian/changelog 2026-09-05 09:44:37.000000000 +0000 @@ -1,3 +1,10 @@ +libyaml-perl (1.31-1+deb13u1) trixie; urgency=medium + + * Team upload. + * fix: Avoid backtracking leading to exponential load time (CVE-2026-63676) + + -- Salvatore Bonaccorso Sat, 05 Sep 2026 11:44:37 +0200 + libyaml-perl (1.31-1) unstable; urgency=medium * Import upstream version 1.31. diff -Nru libyaml-perl-1.31/debian/patches/fix-Avoid-backtracking-leading-to-exponential-load-t.patch libyaml-perl-1.31/debian/patches/fix-Avoid-backtracking-leading-to-exponential-load-t.patch --- libyaml-perl-1.31/debian/patches/fix-Avoid-backtracking-leading-to-exponential-load-t.patch 1970-01-01 00:00:00.000000000 +0000 +++ libyaml-perl-1.31/debian/patches/fix-Avoid-backtracking-leading-to-exponential-load-t.patch 2026-09-05 09:44:37.000000000 +0000 @@ -0,0 +1,27 @@ +From: =?UTF-8?q?Tina=20M=C3=BCller?= +Date: Sun, 19 Jul 2026 00:12:26 +0200 +Subject: fix: Avoid backtracking leading to exponential load time +Origin: https://github.com/ingydotnet/yaml-pm/commit/9388c6a02a66db79f9d2b3727b5588272f612cf1 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-63676 + +Thanks CPANSec! +--- + lib/YAML/Loader.pm | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/YAML/Loader.pm b/lib/YAML/Loader.pm +index b3c9122f2df5..4f73deb65a9b 100644 +--- a/lib/YAML/Loader.pm ++++ b/lib/YAML/Loader.pm +@@ -615,7 +615,7 @@ sub _parse_implicit { + # remove trailing comments and whitespace + $value =~ s/^#.*$//; + $value =~ s/\s+#.*$//; +- $value =~ s/\s*$//; ++ $value =~ s/\s+$//; + return $value if $value eq ''; + return undef if $value =~ /^~$/; + return $value +-- +2.55.0 + diff -Nru libyaml-perl-1.31/debian/patches/series libyaml-perl-1.31/debian/patches/series --- libyaml-perl-1.31/debian/patches/series 2024-01-01 02:43:19.000000000 +0000 +++ libyaml-perl-1.31/debian/patches/series 2026-09-05 09:44:37.000000000 +0000 @@ -1 +1,2 @@ ysh-location.patch +fix-Avoid-backtracking-leading-to-exponential-load-t.patch