CVE-2022-24795

Name of the Vulnerable Software and Affected Versions yajl-ruby versions 1.x through 2.x

Description The issue is related to an integer overflow in the yajl-ruby library, which leads to heap memory corruption when dealing with large inputs (~2GB). The reallocation logic at yajl buf.c#L64 may result in the need 32bit integer wrapping to 0, causing a reallocation of buf->alloc into a small heap chunk. This vulnerability mostly impacts process availability, and maintainers believe exploitation for arbitrary code execution is unlikely.

Recommendations For yajl-ruby versions 1.x through 2.x, update to version 1.4.3 to resolve the issue. As a temporary workaround, avoid passing large inputs to YAJL.