Fedora 45 perl-Dancer2 Critical Deserialization Exploit 2026-5e3eab9a07

Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrary blessed object — the entry point for DESTROY/AUTOLOAD/overload gadget chains — and !!perl/code could ask for a string eval. deserialize now sets $YAML::LoadBlessed = 0 and $YAML::LoadCode = 0 itselfLinuxSecurity – Security AdvisoriesRead More