Debian 9810 Published by

A yajl security update has been released for Debian GNU/Linux 10 LTS to address multiple vulnerabilities.

[SECURITY] [DLA 3492-1] yajl security update

Debian LTS Advisory DLA-3492-1 Tobias Frost
July 11, 2023

Package : yajl
Version : 2.1.0-3+deb10u2
CVE ID : CVE-2017-16516 CVE-2022-24795 CVE-2023-33460
Debian Bug : 1040036

Multiple vulnerabilties have been found in yajl, a JSON parser / small
validating JSON generator# written in ANSI C, which potentially can
cause memory corruption or DoS.

The CVE-20117-16516 had been addressed already in DLA-3478, however the
fix has been found to be incomplete as it missed an additional memory
leak. This update fixes that problem.


When a crafted JSON file is supplied to yajl, the process might
crash with a SIGABRT in the yajl_string_decode function in
yajl_encode.c. This results potentially in a denial of service.


The 1.x branch and the 2.x branch of `yajl` contain an integer
overflow which leads to subsequent heap memory corruption when dealing
with large (~2GB) inputs.


There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse
function, which potentially cause out-of-memory in server and cause

For Debian 10 buster, these problems have been fixed in version

We recommend that you upgrade your yajl packages.

For the detailed security status of yajl please refer to
its security tracker page at:

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: