yajl-ruby gem Denial of Service vulnerability (GHSA-wwh7-4jw9-33x6)
Published: 2017-11-28T22:44:42Z
Aliases: CVE-2017-16516
Severity: HIGH · CWE: CWE-134

In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to `Yajl::Parser.new.parse`, the whole ruby process crashes with a SIGABRT in the `yajl_string_decode` function in `yajl_encode.c`. This results in the whole ruby process terminating and potentially a denial of service.

Affected packages:
package: ecosystem: RubyGems
name: yajl-ruby
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.3.1