Skip to content
OpenAdvisories
Medium · 5.9 CVE-2022-24795 EUVD-2022-1773GHSA-jj47-x69x-mxrm

Buffer Overflow and Integer Overflow in yajl-ruby

Published Apr 5, 2022 · Updated Apr 22, 2025 · Assigned by GitHub_M

Vendor: brianmario Product: yajl-ruby Package: argyll Package: burp Package: burp Package: collada2gltf Package: icinga2 Package: libbson Package: lnav Package: php-mongodb Package: r-cran-jsonlite Package: r-cran-jsonlite Package: ruby-yajl Package: ruby-yajl Package: rubygem-yajl-ruby Package: tulip Package: yajl Package: yajl Package: yajl-ruby Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround, avoid passing large inputs to YAJL.

Affected products

VendorProductAffectedFixed
brianmario yajl-ruby <= 1.4.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 r-cran-jsonlite 1.8.8+dfsg-1 —
Debian 14 ruby-yajl 1.4.3-1 —
Debian 14 yajl 2.1.0-4 —
Debian 13 burp 3.1.4-2 —
Debian 13 r-cran-jsonlite 1.8.8+dfsg-1 —
Debian 13 ruby-yajl 1.4.3-1 —
Debian 13 yajl 2.1.0-4 —
Debian 12 burp +1 No fix yet —
Debian 12 ruby-yajl 1.4.3-1 —
Debian 12 yajl 2.1.0-3+deb12u2 —
Debian 10 burp 2.1.32-2+deb10u1 DLA-3516-1
Debian 10 yajl 2.1.0-3+deb10u2 DLA-3492-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 lnav +6 No fix yet —
Ubuntu 26.04 LTS burp +7 No fix yet —
Ubuntu 25.10 burp +7 No fix yet —
Ubuntu 24.04 LTS burp +6 No fix yet —
Ubuntu 22.04 LTS burp +8 No fix yet —
Ubuntu 22.04 LTS yajl 2.1.0-3ubuntu0.22.04.1 USN-6233-2
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS burp +6 No fix yet —
Ubuntu 20.04 LTS yajl 2.1.0-3ubuntu0.20.04.1 USN-6233-2
Ubuntu 18.04 LTS burp +7 No fix yet —
Ubuntu 16.04 LTS burp +8 No fix yet —
Ubuntu Pro 18.04 LTS libbson No fix yet —
Ubuntu Pro 18.04 LTS yajl 2.1.0-2ubuntu0.18.04.1~esm1 USN-6233-1
Ubuntu Pro 16.04 LTS libbson No fix yet —
Ubuntu Pro 16.04 LTS yajl 2.1.0-2ubuntu0.16.04.1~esm1 USN-6233-1
Ubuntu Pro 14.04 LTS yajl 2.0.4-4ubuntu0.1~esm1 USN-6233-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 yajl +1 2.1.0-21.el9 RHSA-2022:8252
RHEL 8 yajl +1 2.1.0-11.el8 RHSA-2022:7524
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.6 EUS yajl +1 2.1.0-13.el8_6 RHSA-2024:2063

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 yajl +1 2.1.0-21.el9 ALSA-2022:8252
AlmaLinux 8 yajl +1 2.1.0-11.el8 ALSA-2022:7524

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 yajl 2.1.0-21.el9 RLSA-2022:8252
Rocky Linux 8 yajl 2.1.0-11.el8 RLSA-2022:7524

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 libyajl 2.1.0-150000.4.3.1 SUSE-SU-2022:3162-1
SLES 15 SP3 libyajl 2.1.0-150000.4.3.1 SUSE-SU-2022:3162-1
SLES 12 SP5 libyajl 2.0.1-18.7.1 SUSE-SU-2022:1746-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP5 libyajl 2.0.1-18.7.1 SUSE-SU-2022:1746-1
SLE Micro 5.2 libyajl 2.1.0-150000.4.3.1 SUSE-SU-2022:3162-1
SLE Micro 5.1 libyajl 2.1.0-150000.4.3.1 SUSE-SU-2022:3162-1
SUSE OpenStack Cloud Crowbar 9 rubygem-yajl-ruby 1.3.1-4.6.1 SUSE-SU-2022:1918-1
SUSE OpenStack Cloud Crowbar 8 rubygem-yajl-ruby 1.3.1-4.6.1 SUSE-SU-2022:1918-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.4 libyajl 2.1.0-150000.4.3.1 SUSE-SU-2022:3162-1
openSUSE Leap 15.3 libyajl 2.1.0-150000.4.3.1 SUSE-SU-2022:3162-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.2 libyajl 2.1.0-150000.4.3.1 SUSE-SU-2022:3162-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 yajl +1 2.1.0-16.amzn2023.0.4 ALAS2023-2023-263
Amazon Linux 2 yajl +1 2.0.4-4.amzn2.0.2 ALAS2-2023-2101

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 rubygem-yajl-ruby 1.4.3-1 —
Azure Linux 2 (CBL-Mariner) rubygem-yajl-ruby 1.3.1-2 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 yajl +1 2.1.0-21.el9 ELSA-2022-8252
Oracle Linux 8 yajl +1 2.1.0-11.el8 ELSA-2022-7524

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems yajl-ruby < 1.4.3 1.4.3 GHSA-jj47-x69x-mxrm

Advisories 19

References