Skip to main content
HIGH

CVE-2022-24795

CVSS v3

7.5

HIGH

EPSS Score

3.5 %

exploit probability, as of 2026-10-19

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Get an alert for each new CVE published for yajl-ruby.

Set up CVE WatchFree account · no credit card

Affected and fixed versions

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • yajl-rubyRubyGemsall versions · fixed in 1.4.3
  • yajlAlmaLinux:9all versions · fixed in 2.1.0-21.el9and 1 other package
  • yajlAlmaLinux:8all versions · fixed in 2.1.0-11.el8and 1 other package

Vendor advisories

  • CVE-2022-24795 Red Hat Product Security126 products fixed · 13 known affected

    yajl: heap-based buffer overflow when handling large inputs due to an integer overflow

    yajl-devel as a component of Red Hat Enterprise Linux 6 · yajl.src as a component of Red Hat Enterprise Linux 6 · yajl-devel as a component of Red Hat Enterprise Linux 7

  • RHSA-2024:2063 Red Hat Product Security31 products fixed

    Red Hat Security Advisory: yajl security update

  • RHSA-2022:8252 Red Hat Product Security31 products fixed

    Red Hat Security Advisory: yajl security update

  • RHSA-2022:7524 Red Hat Product Security31 products fixed

    Red Hat Security Advisory: yajl security update

Full record on NVD

Description

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround, avoid passing large inputs to YAJL.

Technical details

Published
2022-04-05

Frequently asked questions

What is CVE-2022-24795?

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround, avoid passing large inputs to YAJL.

Is CVE-2022-24795 actively exploited?

Active exploitation of CVE-2022-24795 has not been confirmed. Its EPSS score was 3.5% on 2026-10-19, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2022-24795?

CVE-2022-24795 has a CVSS v3 base score of 7.5 (HIGH severity).

Running yajl-ruby? Hear about its next vulnerability

CVE Watch matches each new CVE to the vendors and products you list (vendor and product, not the version) and puts it in your alerts with its KEV and EPSS status.

Get alerts for this productCISA KEV additions, October 2026Search CVEs

Already have an account? Open CVE WatchNo credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database