CVE-2022-24795

A flaw was found in the YAJL library in the way it reallocates a memory buffer to store more data. A very large input causes the value used to calculate the buffer size to overflow, resulting in a heap-based buffer overflow.

Red Hat Enterprise Linux only ships YAJL 2.x versions and on 32-bit systems, more than 2GiB of data will be required for triggering this bug. However, on 64-bit systems, more than 9EiB of data will be needed, making this vulnerability very hard to be exploited on these systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid passing large inputs to the YAJL library.