{"id":"CVE-2017-16516","aliases":["DEBIAN-CVE-2017-16516","DLA-1167-1","DLA-3492-1","DLA-3516-1","EUVD-2017-0355","GHSA-wwh7-4jw9-33x6","MGASA-2024-0066","OESA-2025-1156","UBUNTU-CVE-2017-16516","USN-6233-1","USN-6233-2"],"status":"published","title":"yajl-ruby gem Denial of Service vulnerability","description":"In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03767,"percentile":0.89983,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-134"],"published":"2017-11-03T00:00:00Z","modified":"2026-10-20T10:49:51Z","fixes":[{"ecosystem":"RubyGems","package":"yajl-ruby","fixed_in":["1.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"burp","fixed_in":["3.1.4-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"r-cran-jsonlite","fixed_in":["1.8.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"r-cran-jsonlite","fixed_in":["1.8.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ruby-yajl","fixed_in":["1.2.0-3.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-yajl","fixed_in":["1.2.0-3.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-yajl","fixed_in":["1.2.0-3.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"yajl","fixed_in":["2.1.0-3+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"yajl","fixed_in":["2.1.0-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"yajl","fixed_in":["2.1.0-4"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"ruby-yajl","fixed_in":["1.1.0-2+deb7u1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"yajl","fixed_in":["2.1.0-21.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"yajl","fixed_in":["2.1.0-21.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"yajl","fixed_in":["2.1.0-19.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"yajl","fixed_in":["2.1.0-21.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"yajl","fixed_in":["2.1.0-21.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"yajl","fixed_in":["2.0.4-4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"yajl","fixed_in":["2.1.0-2ubuntu0.16.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"yajl","fixed_in":["2.1.0-2ubuntu0.18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"yajl","fixed_in":["2.1.0-3ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"yajl","fixed_in":["2.1.0-3ubuntu0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"yajl-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"burp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4-1","3.1.4-3","3.1.4-3.1","3.1.4-4","3.1.4-5"]},{"source":"osv","ecosystem":"Debian:13","package":"burp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"r-cran-jsonlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.4+dfsg-1","1.8.5+dfsg-1","1.8.7+dfsg-1","1.8.8+dfsg-1","1.8.9+dfsg-1","1.9.1+dfsg-1","2.0.0+dfsg-1","2.0.0+dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"r-cran-jsonlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"r-cran-jsonlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-3.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-3.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-3.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-3+deb12u2"}]}],"versions":["2.1.0-3","2.1.0-3+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"ruby-yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2+deb7u1"}]}],"versions":["1.1.0-2"]},{"source":"osv","ecosystem":"Debian:10","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-3+deb10u2"}]}],"versions":["2.1.0-3","2.1.0-3+deb10u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:10","package":"burp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.32-2+deb10u1"}]}],"versions":["2.1.32-2"],"bundled":2},{"source":"osv","ecosystem":"RubyGems","package":"yajl-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1"}]}],"versions":["0.5.10","0.5.11","0.5.12","0.5.5","0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.7.9","0.8.0","0.8.1","0.8.2","0.8.3","1.0.0","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0"]},{"source":"osv","ecosystem":"Mageia:9","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-6.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-19.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-4ubuntu0.1~esm1"}]}],"versions":["2.0.4-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-2ubuntu0.16.04.1~esm1"}]}],"versions":["2.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-3build1","1.2.0-3build2","1.2.0-3build3","1.2.0-3build4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-2ubuntu0.18.04.1~esm1"}]}],"versions":["2.1.0-2","2.1.0-2build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-3ubuntu0.20.04.1"}]}],"versions":["2.1.0-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-3ubuntu0.22.04.1"}]}],"versions":["2.1.0-3","2.1.0-3build1","2.1.0-3build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-4ubuntu0.1~esm1"}]}],"versions":["2.0.4-4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-2ubuntu0.16.04.1~esm1"}]}],"versions":["2.1.0-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-2ubuntu0.18.04.1~esm1"}]}],"versions":["2.1.0-2","2.1.0-2build1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-3ubuntu0.20.04.1"}]}],"versions":["2.1.0-3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"yajl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-3ubuntu0.22.04.1"}]}],"versions":["2.1.0-3","2.1.0-3build1","2.1.0-3build2"],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"yajl-ruby_project","product":"yajl-ruby"}],"references":[{"url":"https://rubygems.org/gems/yajl-ruby","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/brianmario/yajl-ruby/issues/176","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00010.html","tags":["mailing-list","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/07/msg00013.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00003.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16516","tags":["advisory"]},{"url":"https://github.com/github/advisory-database/pull/2158","tags":["web"]},{"url":"https://github.com/brianmario/yajl-ruby/commit/a8ca8f476655adaa187eedc60bdc770fff3c51ce","tags":["web"]},{"url":"https://github.com/brianmario/yajl-ruby/pull/178","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yajl-ruby/CVE-2017-16516.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wwh7-4jw9-33x6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-16516","tags":["advisory"]},{"url":"https://github.com/brianmario/yajl-ruby","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2024-0066.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32072","tags":["report"]},{"url":"https://www.debian.org/lts/security/2023/dla-3478","tags":["web"]},{"url":"https://www.debian.org/lts/security/2023/dla-3492","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1156","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-16516","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6233-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6233-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16516","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-33460","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-16516","description":"In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.","status":"published","published":"2017-11-03T00:00:00Z","modified":"2024-08-05T20:27:04.174Z","updated_at":"2026-11-02T14:33:21.453505Z"}],"euvd":[{"id":"EUVD-2017-0355","description":"In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.","status":"published","published":"2017-11-03T00:00:00Z","modified":"2024-08-05T20:27:04Z","updated_at":"2026-11-03T02:23:12.50701Z"}],"ghsa":[{"id":"GHSA-wwh7-4jw9-33x6","title":"yajl-ruby gem Denial of Service vulnerability","description":"In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to `Yajl::Parser.new.parse`, the whole ruby process crashes with a SIGABRT in the `yajl_string_decode` function in `yajl_encode.c`. This results in the whole ruby process terminating and potentially a denial of service.","status":"published","published":"2017-11-28T22:44:42Z","modified":"2023-11-05T05:04:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:37:13.301199Z"}],"nvd":[{"id":"CVE-2017-16516","description":"In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.","status":"published","published":"2017-11-03T15:29:00.233Z","modified":"2026-06-17T01:09:23.183Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:04:08.01771Z"}],"osv":[{"id":"CVE-2017-16516","description":"In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.","status":"published","published":"2017-11-03T15:29:00.233Z","modified":"2026-10-20T10:49:51.025973032Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-16516","description":"In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.","status":"published","published":"2017-11-03T15:29:00.233Z","modified":"2026-09-01T20:03:45.388396658Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"GHSA-wwh7-4jw9-33x6","title":"yajl-ruby gem Denial of Service vulnerability","description":"In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to `Yajl::Parser.new.parse`, the whole ruby process crashes with a SIGABRT in the `yajl_string_decode` function in `yajl_encode.c`. This results in the whole ruby process terminating and potentially a denial of service.","status":"published","published":"2017-11-28T22:44:42Z","modified":"2024-02-16T08:18:26.15193Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"OESA-2025-1156","title":"yajl security update","description":"yajl is a small event-driven JSON parser written in ANSI C, and a small validating JSON generator.\r\n\r\nSecurity Fix(es):\n\nIn the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.(CVE-2017-16516)","status":"published","published":"2025-02-21T11:08:15Z","modified":"2026-08-18T01:18:47.90460008Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2017-16516","description":"In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.","status":"published","published":"2017-11-03T15:29:00Z","modified":"2026-04-22T11:18:57.645969Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"DLA-1167-1","title":"ruby-yajl - security update","status":"published","published":"2017-11-08T00:00:00Z","modified":"2026-03-09T01:01:29.506318Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-3492-1","title":"yajl - security update","status":"published","published":"2023-07-11T00:00:00Z","modified":"2026-03-09T01:23:22.692446Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3516-1","title":"burp - security update","status":"published","published":"2023-08-05T00:00:00Z","modified":"2026-03-09T01:21:57.779435Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2024-0066","title":"Updated yajl packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nIn the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is\nsupplied to Yajl::Parser.new.parse, the whole ruby process crashes with\na SIGABRT in the yajl_string_decode function in yajl_encode.c. This\nresults in the whole ruby process terminating and potentially a denial\nof service. (CVE-2017-16516)\nThere's a memory leak in yajl 2.1.0 with use of yajl_tree_parse\nfunction. which will cause out-of-memory in server and cause crash.\n(CVE-2023-33460)\n","status":"published","published":"2024-03-15T22:51:55Z","modified":"2026-04-16T04:43:35.56997271Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"USN-6233-1","title":"yajl vulnerabilities","description":"It was discovered that YAJL was not properly performing bounds checks when\ndecoding a string with escape sequences. If a user or automated system\nusing YAJL were tricked into processing specially crafted input, an\nattacker could possibly use this issue to cause a denial of service\n(application abort). (CVE-2017-16516)\n\nIt was discovered that YAJL was not properly handling memory allocation\nwhen dealing with large inputs, which could lead to heap memory\ncorruption. If a user or automated system using YAJL were tricked into\nrunning a specially crafted large input, an attacker could possibly use\nthis issue to cause a denial of service. (CVE-2022-24795)\n\nIt was discovered that memory leaks existed in one of the YAJL parsing\nfunctions. An attacker could possibly use this issue to cause a denial of\nservice (memory exhaustion). (CVE-2023-33460)\n","status":"published","published":"2023-07-18T13:31:52Z","modified":"2026-06-29T13:50:54.329530594Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-6233-2","title":"yajl vulnerabilities","description":"USN-6233-1 fixed vulnerabilities in YAJL. This update provides the\ncorresponding updates for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu\n23.04.\n\nOriginal advisory details:\n\n It was discovered that YAJL was not properly performing bounds checks when\n decoding a string with escape sequences. If a user or automated system\n using YAJL were tricked into processing specially crafted input, an\n attacker could possibly use this issue to cause a denial of service\n (application abort). (CVE-2017-16516)\n \n It was discovered that YAJL was not properly handling memory allocation\n when dealing with large inputs, which could lead to heap memory\n corruption. If a user or automated system using YAJL were tricked into\n running a specially crafted large input, an attacker could possibly use\n this issue to cause a denial of service. (CVE-2022-24795)\n \n It was discovered that memory leaks existed in one of the YAJL parsing\n functions. An attacker could possibly use this issue to cause a denial of\n service (memory exhaustion). (CVE-2023-33460)\n","status":"published","published":"2023-12-14T16:51:18Z","modified":"2026-04-27T16:30:59.760532Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}