Skip to content

Vendor

yajl-ruby project vulnerabilities

2 published CVES affecting yajl-ruby project, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
2
Medium
0
Low
0
Unscored
0
CISA KEV
0
Atom feed of yajl-ruby project alerts

Products

Latest yajl-ruby project CVEs

Newest publication first

  1. CVE-2022-24795 Buffer Overflow and Integer Overflow in yajl-ruby

    Published
    HighCVSS 7.5 EPSS 3.4% PoC

    yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at yajl_buf.c#L64 may res...

  2. CVE-2017-16516 yajl-ruby gem Denial of Service vulnerability

    Published
    HighCVSS 7.5 EPSS 3.8% PoC

    In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of s...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.