Memory Leak in yajl 2.1.0 with yajl_tree_parse Function
Summary
CVE-2023-33460: There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash. Affects yajl across 2 version ranges.
< 2.1.0-r9
< a0ecdde0c042b9256170f2f8890dd9451a4240aa
Fixed in 2.1.0-r9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The yajl package is a JSON parsing and generation library written in C. It provides a simple and efficient API for working with JSON data. The package is widely used in various applications and frameworks. However, in version 2.1.0 of yajl, there is a memory leak issue when using the yajl_tree_parse function. This vulnerability can lead to an out-of-memory condition in the server, causing it to crash.
Vulnerability Detail
The memory leak vulnerability in yajl 2.1.0 arises from improper memory management in the yajl_tree_parse function. When this function is used, it fails to release allocated memory properly, resulting in a continuous accumulation of memory usage. As a consequence, the server's memory resources are exhausted, leading to a crash. This vulnerability can be exploited by an attacker to disrupt the availability of the affected server.
How To Fix
Minimum fixed version
2.1.0-r9
This is the first release that contains the fix.
sudo apk add --upgrade yajlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the yajl package to a patched version.
Conclusion
In conclusion, the yajl 2.1.0 version suffers from a memory leak vulnerability in the yajl_tree_parse function. This vulnerability can be exploited to cause a server crash due to an out-of-memory condition. Users are advised to upgrade their yajl installations to version 2.1.0-r9 or later to mitigate this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yajl →
FAQ
yajl is a JSON parsing and generation library written in C. It provides a simple and efficient API for working with JSON data.
The vulnerability can cause a memory leak in the server, leading to an out-of-memory condition and eventual crash.
An attacker can exploit this vulnerability by sending specially crafted JSON data that triggers the memory leak, causing the server to crash.
Yes, upgrading the yajl package to version 2.1.0-r9 or later resolves this vulnerability.
No, there are no known workarounds. It is necessary to apply the recommended fix by upgrading the yajl package.
Related vulnerabilities
Recent vulnerabilities recorded for yajl.
