Memory Leak Vulnerability in yajl Package Leading to Server Crashes
Summary
ALPINE-CVE-2023-33460: There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash. Affects yajl versions < 2.1.0-r9. Fixed in 2.1.0-r9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The yajl (Yet Another JSON Library) package is a C library designed for parsing JSON data. It is known for its efficiency and ease of use, making it a popular choice among developers for handling JSON in various applications. However, a critical vulnerability has been identified in versions prior to 2.1.0-r9, which can lead to memory leaks when using the yajl_tree_parse function, potentially causing servers to run out of memory and crash.
Vulnerability Detail
The vulnerability identified as ALPINE-CVE-2023-33460 arises from a memory leak in the yajl library, specifically when the yajl_tree_parse function is utilized. This flaw can lead to excessive memory consumption, resulting in out-of-memory errors that can crash the server. The issue is present in versions of the yajl package before 2.1.0-r9 across multiple Alpine Linux versions (v3.19, v3.20, v3.21, and v3.22). The CVSS score for this vulnerability is 6.5, indicating a moderate level of risk.
How To Fix
Minimum fixed version
2.1.0-r9
This is the first release that contains the fix.
sudo apk add --upgrade yajlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider limiting the usage of the yajl_tree_parse function or monitoring memory usage closely to mitigate the impact of the memory leak until a proper update can be applied.
Conclusion
The memory leak vulnerability in the yajl package poses a significant risk to applications using this library, particularly in server environments. It is crucial to update to the patched version to mitigate the risk of crashes due to memory exhaustion. Utilizing tools like Vulert can further enhance your security posture by providing real-time vulnerability monitoring.
See every vulnerability recorded for yajl →
FAQ
The memory leak can lead to increased memory consumption, potentially causing the server to run out of memory and crash.
Versions of yajl prior to 2.1.0-r9 are affected across Alpine Linux versions v3.19, v3.20, v3.21, and v3.22.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the yajl package to version 2.1.0-r9 or later using the command 'apk add --update yajl=2.1.0-r9'.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights into potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for yajl.
