CVE catalog

CVE-2023-33460

r-cran-jsonlite: CVE-2023-33460

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.13% · Oct 25, 2026

A flaw was found in the yajl library, which exists due to a memory leak within the yajl_tree_parse() function. This flaw allows a remote attacker to parse malicious JSON input to cause out-of-memory in the server, causing a crash, resulting in a denial of service attack. yajl: Memory leak in yajl_tree_parse function The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianyajlsid2.1.0-7fixed
Debianyajlforky2.1.0-7fixed
Debianyajltrixie2.1.0-5fixed
Debianyajlbookworm2.1.0-3+deb12u2fixed
Debianruby-yajlsid1.4.3-2not affected
Debianruby-yajlforky1.4.3-2not affected
Debianruby-yajltrixie1.4.3-1not affected
Debianruby-yajlbookworm1.4.3-1not affected
Debianepics-basesid7.0.8.1+dfsg1-10not affected
Debianepics-baseforky7.0.8.1+dfsg1-10not affected
Debianepics-basetrixie7.0.8.1+dfsg1-7+deb13u1not affected
Debianepics-basebookworm7.0.3.1-4not affected
Debianr-cran-jsonlitesid2.0.0+dfsg-2fixed
Debianr-cran-jsonliteforky2.0.0+dfsg-2fixed
Debianr-cran-jsonlitetrixie1.9.1+dfsg-1fixed
Debianr-cran-jsonlitebookworm1.8.4+dfsg-1vulnerable
Alpineyajl3.192.1.0-r9fixed
Alpineyajl3.202.1.0-r9fixed
Alpineyajl3.212.1.0-r9fixed
Alpineyajl3.222.1.0-r9fixed
Alpineyajl3.232.1.0-r9fixed
Alpineyajl3.242.1.0-r9fixed
Suselibyajllinux enterprise micro 5.32.1.0-150000.4.6.1fixed
Suselibyajllinux enterprise micro 5.42.1.0-150000.4.6.1fixed
Suselibyajllinux enterprise module for basesystem 15 sp42.1.0-150000.4.6.1fixed
Suselibyajllinux enterprise module for basesystem 15 sp52.1.0-150000.4.6.1fixed
Suselibyajllinux enterprise real time 15 sp32.1.0-150000.4.6.1fixed
Suselibyajlmanager proxy 4.22.1.0-150000.4.6.1fixed
Suselibyajlmanager server 4.22.1.0-150000.4.6.1fixed
Suselibyajllinux enterprise micro 5.12.1.0-150000.4.6.1fixed
Suselibyajllinux enterprise micro 5.22.1.0-150000.4.6.1fixed
Opensuselibyajlleap micro 5.32.1.0-150000.4.6.1fixed
Opensuselibyajlleap micro 5.42.1.0-150000.4.6.1fixed
Opensuselibyajlleap 15.42.1.0-150000.4.6.1fixed
Opensuselibyajlleap 15.52.1.0-150000.4.6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianyajlsourcesid2.1.0-5not yet assignedNot reported[1039984]
Debianyajlsourceforky2.1.0-5not yet assignedNot reported[1039984]
Debianyajlsourcetrixie2.1.0-5not yet assignedNot reported[1039984]
Debianyajlsourcebookworm2.1.0-3+deb12u2not yet assignedNot reported[1039984]
Debianruby-yajlsourcesidNot affectedunimportantNot reportedNot reported
Debianruby-yajlsourceforkyNot affectedunimportantNot reportedNot reported
Debianruby-yajlsourcetrixieNot affectedunimportantNot reportedNot reported
Debianruby-yajlsourcebookwormNot affectedunimportantNot reportedNot reported
Debianepics-basesourcesidNot affectedunimportantNot reportedNot reported
Debianepics-basesourceforkyNot affectedunimportantNot reportedNot reported
Debianepics-basesourcetrixieNot affectedunimportantNot reportedNot reported
Debianepics-basesourcebookwormNot affectedunimportantNot reportedNot reported
Debianr-cran-jsonlitesourcesid1.8.8+dfsg-1not yet assignedNot reported[1059317]
Debianr-cran-jsonlitesourceforky1.8.8+dfsg-1not yet assignedNot reported[1059317]
Debianr-cran-jsonlitesourcetrixie1.8.8+dfsg-1not yet assignedNot reported[1059317]
Debianr-cran-jsonlitesourcebookworm(unfixed)not yet assignedNot reported[1059317]
Alpineyajlapk3.192.1.0-r9Not reportedALPINE-CVE-2023-33460Not reported
Alpineyajlapk3.202.1.0-r9Not reportedALPINE-CVE-2023-33460Not reported
Alpineyajlapk3.212.1.0-r9Not reportedALPINE-CVE-2023-33460Not reported
Alpineyajlapk3.222.1.0-r9Not reportedALPINE-CVE-2023-33460Not reported
Alpineyajlapk3.232.1.0-r9Not reportedALPINE-CVE-2023-33460Not reported
Alpineyajlapk3.242.1.0-r9Not reportedALPINE-CVE-2023-33460Not reported
Suselibyajlrpmlinux enterprise micro 5.32.1.0-150000.4.6.1Not reportedSUSE-SU-2023:3301-1Not reported
Suselibyajlrpmlinux enterprise micro 5.42.1.0-150000.4.6.1Not reportedSUSE-SU-2023:3301-1Not reported
Suselibyajlrpmlinux enterprise module for basesystem 15 sp42.1.0-150000.4.6.1Not reportedSUSE-SU-2023:3301-1Not reported
Suselibyajlrpmlinux enterprise module for basesystem 15 sp52.1.0-150000.4.6.1Not reportedSUSE-SU-2023:3301-1Not reported
Suselibyajlrpmlinux enterprise real time 15 sp32.1.0-150000.4.6.1Not reportedSUSE-SU-2023:3301-1Not reported
Suselibyajlrpmmanager proxy 4.22.1.0-150000.4.6.1Not reportedSUSE-SU-2023:3301-1Not reported
Suselibyajlrpmmanager server 4.22.1.0-150000.4.6.1Not reportedSUSE-SU-2023:3301-1Not reported
Suselibyajlrpmlinux enterprise micro 5.12.1.0-150000.4.6.1Not reportedSUSE-SU-2023:3301-1Not reported
Suselibyajlrpmlinux enterprise micro 5.22.1.0-150000.4.6.1Not reportedSUSE-SU-2023:3301-1Not reported
Opensuselibyajlrpmleap micro 5.32.1.0-150000.4.6.1Not reportedSUSE-SU-2023:3301-1Not reported
Opensuselibyajlrpmleap micro 5.42.1.0-150000.4.6.1Not reportedSUSE-SU-2023:3301-1Not reported
Opensuselibyajlrpmleap 15.42.1.0-150000.4.6.1Not reportedSUSE-SU-2023:3301-1Not reported
Opensuselibyajlrpmleap 15.52.1.0-150000.4.6.1Not reportedSUSE-SU-2023:3301-1Not reported

[Debian bug #1039984][Debian bug #1059317]

Notes

[bookworm] r-cran-jsonlite: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]