CVE-2026-24825: 
Linux Red Hat vulnerability analysis and mitigation

CVE-2026-24825 is a memory leak vulnerability (Missing Release of Memory after Effective Lifetime) in the ydb-platform/ydb open-source distributed database, specifically within the contrib/libs/yajl module's yajl_tree.c file. The vulnerability stems from a cloned copy of the YAJL library that did not receive the upstream security patch originally tracked as CVE-2023-33460. It affects ydb versions through 24.4.4.2 and was publicly disclosed on January 27, 2026. The CVSS v4.0 base score is 6.9 (Medium), assigned by GovTech CSG (Feedly, EUVD).

The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime): the yajl_tree_parse() function in the bundled YAJL library fails to free allocated memory under certain parsing conditions, resulting in a memory leak. The vulnerability exists because ydb's contrib/libs/yajl directory is a mirror of an external repository and did not receive the security fix applied upstream in likema/yajl (commit 31531a6). An unauthenticated remote attacker can trigger the leak by repeatedly sending crafted JSON input to any ydb component that invokes yajl_tree_parse(), causing progressive memory exhaustion. The fix was applied in ydb PR #17570, which ports the upstream patch (GitHub PR).

Successful exploitation leads to gradual memory exhaustion on the affected ydb server, ultimately causing denial of service (DoS) as system memory is consumed without release. There is no confidentiality or integrity impact — the vulnerability is limited to availability, affecting both the vulnerable system and potentially dependent subsystems (sub-availability impact: LOW). Recovery requires user intervention to restart affected services (Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-24825. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability is automatable (no user interaction or privileges required), meaning repeated network requests can trigger it without authentication. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus detection plugin ID 297572 is available for scanning (Feedly).

1. Reconnaissance: Identify internet-facing ydb instances running version 24.4.4.2 or earlier using network scanning tools or service fingerprinting.
2. Craft malicious JSON input: Prepare a JSON payload designed to trigger the yajl_tree_parse() function's memory leak path — for example, deeply nested or malformed JSON structures that cause partial allocation without cleanup.
3. Send repeated requests: Repeatedly submit the crafted JSON payload to any ydb endpoint that processes JSON via the vulnerable YAJL module, without requiring authentication or special privileges.
4. Exhaust memory: Through sustained automated requests, progressively consume server memory until the ydb process becomes unresponsive or crashes, achieving denial of service (GitHub PR, Feedly).

• Network: Unusually high volume of JSON-bearing requests to ydb endpoints from a single or rotating set of source IPs; sustained connection attempts without corresponding legitimate workload.
• System: Steadily increasing memory consumption by the ydb process (ydb or related service) observable via top, htop, or system monitoring tools without a corresponding increase in legitimate query load.
• Logs: ydb service logs showing repeated invocations of JSON parsing functions with no corresponding memory release; out-of-memory (OOM) kernel messages (dmesg) referencing the ydb process.
• Process: ydb process eventually terminating with an OOM kill signal or becoming unresponsive, requiring manual restart.

The fix was merged into the ydb-platform/ydb main branch on April 26, 2025 (commit aeb8daa) via PR #17570, which applies the upstream YAJL patch from likema/yajl@31531a6. Users should upgrade to any ydb release built from the main branch after April 26, 2025 (i.e., versions after 24.4.4.2). As a temporary workaround, restrict network access to ydb endpoints to trusted clients only, and implement rate limiting on JSON-processing endpoints to reduce the impact of repeated requests. Monitor memory usage of ydb processes and configure automatic service restarts as a resilience measure (GitHub PR).

The vulnerability was reported by contributor npt-1707, who submitted the fix as a community pull request and subsequently filed the CVE after the patch was merged. The ydb maintainer (maximyurchuk) noted that the contrib directory is a mirror of an external repository, indicating the fix needed to be tracked internally (ticket DEVTOOLSSUPPORT-61900). The patch was also propagated to related Yandex projects including ytsaurus and yatool. No significant broader media coverage or security community discussion has been identified (GitHub PR).