Description
In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.
References (5)
Scores
CVSS v3
7.5
EPSS
0.0168
EPSS Percentile
82.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-134
Status
published
Products (3)
debian/debian_linux
7.0
rubygems/yajl-ruby
0 - 1.3.1RubyGems
yajl-ruby_project/yajl-ruby
1.3.0
Published
Nov 03, 2017
Tracked Since
Feb 18, 2026