yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool_free function lacks loop checks. (pool_free is part of the pool series allocator, along with pool_malloc and pool_realloc.)
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/ibireme/yyjson(SwiftURL) | 0 | 0.9.0 | N/A |
CVSS Metrics
