CVE-2023-33460
yajl: Memory leak in yajl_tree_parse function
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · June 6, 2023
Updated · November 21, 2025
Description
A flaw was found in the yajl library, which exists due to a memory leak within the yajl_tree_parse() function. This flaw allows a remote attacker to parse malicious JSON input to cause out-of-memory in the server, causing a crash, resulting in a denial of service attack.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-401 · Missing Release of Memory after Effective Lifetime