CPANSA-Sereal-Encoder-2024-14031: Sereal-Encoder vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2026-03-31T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2026-03-31T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | 8.1 | Severity | |
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
Vulnerabilities
CVE-2024-14031
Vulnerability DescriptionSereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.
Sereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
| Weakness | CWE-787 : Out-of-bounds Write |
|---|
Product status
Known affected
| Product | Score | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Sereal-Encoder greater than or equal 4.000 and less than 4.010 |
|
Fixed
- Sereal-Encoder greater than or equal 4.010
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-Sereal-Encoder-2024-14031 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-sereal-encoder-2024-14031.json - https://github.com/advisories/GHSA-w77f-wv46-4vcx external
https://github.com/advisories/GHSA-w77f-wv46-4vcx - https://metacpan.org/release/YVES/Sereal-Encoder-4.010/changes external
https://metacpan.org/release/YVES/Sereal-Encoder-4.010/changes - https://www.cve.org/CVERecord?id=CVE-2019-11922 external
https://www.cve.org/CVERecord?id=CVE-2019-11922 - CVE-2024-14031 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2024-14031
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Tue Mar 31 00:00:00 2026 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/