In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade yajlUpgrade ruby-yajlUpgrade burpUpgrade r-cran-jsonlite | Feb 25, 2019 | Nov 3, 2017 |
| Huawei Euleros 2_0_sp12 | — | Upgrade yajl | Jun 11, 2025 | Nov 22, 2017 |
| Ubuntu | — | Upgrade libyajl2 (Ubuntu Pro)Upgrade libyajl2 | Jul 19, 2023 | Nov 3, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub