The vulnerability is a missing release of memory after the effective lifetime in the yajl_tree_parse function within the ydb-platform/ydb contrib/libs/yajl modules. When the server processes input that triggers this function, the allocated memory is never freed, leading to progressive exhaustion of system memory and eventually causing the server to crash. The primary consequence of this flaw is a denial of service, where legitimate services become unavailable as the database process terminates.

ydb-platform ydb versions up to and including 24.4.4.2 are affected. All installations of this version running the default server component are susceptible to the memory leak unless a newer release is deployed.

With a CVSS score of 6.9, the flaw poses a medium severity risk. The EPSS score of less than 1% indicates a low probability of exploitation at this time, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is through parsing of malicious or overly large JSON payloads processed by the server, which can be triggered remotely over the network if the input endpoint is exposed. No known mitigations are publicly documented beyond applying a patch that releases the allocated memory.