CVE-2024-14030 (GCVE-0-2024-14030)

Vulnerability from cvelistv5 – Published: 2026-03-31 11:31 – Updated: 2026-04-01 16:29
VLAI?
Title
Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library
Summary
Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
Severity ?
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-1395 - Dependency on Vulnerable Third-Party Component
Assigner
References
Impacted products
Vendor Product Version
YVES Sereal::Decoder Affected: 4.000 , ≤ 4.009_002 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-14030",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T14:18:18.323057Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1395",
                "description": "CWE-1395 Dependency on Vulnerable Third-Party Component",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T14:18:55.221Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "Sereal-Decoder",
          "product": "Sereal::Decoder",
          "repo": "https://github.com/Sereal/Sereal",
          "vendor": "YVES",
          "versions": [
            {
              "lessThanOrEqual": "4.009_002",
              "status": "affected",
              "version": "4.000",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\n\nSereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1395",
              "description": "CWE-1395 Dependency on Vulnerable Third-Party Component",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-01T16:29:33.903Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/advisories/GHSA-w77f-wv46-4vcx"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-11922"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/YVES/Sereal-Decoder-4.010/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Sereal::Decoder version 4.010 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2017-02-06T00:00:00.000Z",
          "value": "Sereal::Decoder version 4.001_001 released."
        },
        {
          "lang": "en",
          "time": "2018-12-27T00:00:00.000Z",
          "value": "Zstandard 1.3.8 released."
        },
        {
          "lang": "en",
          "time": "2019-07-25T00:00:00.000Z",
          "value": "CVE-2019-11922 for Zstandard published"
        },
        {
          "lang": "en",
          "time": "2020-02-04T00:00:00.000Z",
          "value": "Sereal::Decoder version 4.010 released."
        },
        {
          "lang": "en",
          "time": "2023-02-09T00:00:00.000Z",
          "value": "Advisory added to the CPANSA database."
        },
        {
          "lang": "en",
          "time": "2024-02-17T00:00:00.000Z",
          "value": "Advisory updated in the CPANSA database."
        }
      ],
      "title": "Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2024-14030",
    "datePublished": "2026-03-31T11:31:08.541Z",
    "dateReserved": "2026-03-28T19:49:07.023Z",
    "dateUpdated": "2026-04-01T16:29:33.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-14030\",\"sourceIdentifier\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\",\"published\":\"2026-03-31T12:16:26.153\",\"lastModified\":\"2026-04-01T17:16:56.710\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\\n\\nSereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://github.com/advisories/GHSA-w77f-wv46-4vcx\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"},{\"url\":\"https://metacpan.org/release/YVES/Sereal-Decoder-4.010/changes\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"},{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2019-11922\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-14030\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-31T14:18:18.323057Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1395\", \"description\": \"CWE-1395 Dependency on Vulnerable Third-Party Component\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-31T14:17:35.906Z\"}}], \"cna\": {\"title\": \"Sereal::Decoder versions from 4.000 through 4.009_002 for Perl is vulnerable to a buffer overwrite flaw in the Zstandard library\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"affected\": [{\"repo\": \"https://github.com/Sereal/Sereal\", \"vendor\": \"YVES\", \"product\": \"Sereal::Decoder\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.000\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.009_002\"}], \"packageName\": \"Sereal-Decoder\", \"collectionURL\": \"https://cpan.org/modules\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2017-02-06T00:00:00.000Z\", \"value\": \"Sereal::Decoder version 4.001_001 released.\"}, {\"lang\": \"en\", \"time\": \"2028-12-27T00:00:00.000Z\", \"value\": \"Zstandard 1.3.8 released.\"}, {\"lang\": \"en\", \"time\": \"2019-07-25T00:00:00.000Z\", \"value\": \"CVE-2019-11922 for Zstandard published\"}, {\"lang\": \"en\", \"time\": \"2020-02-04T00:00:00.000Z\", \"value\": \"Sereal::Decoder version 4.010 released.\"}, {\"lang\": \"en\", \"time\": \"2023-02-09T00:00:00.000Z\", \"value\": \"Advisory added to the CPANSA database.\"}, {\"lang\": \"en\", \"time\": \"2024-02-17T00:00:00.000Z\", \"value\": \"Advisory updated in the CPANSA database.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to Sereal::Decoder version 4.010 or later.\"}], \"references\": [{\"url\": \"https://github.com/advisories/GHSA-w77f-wv46-4vcx\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2019-11922\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://metacpan.org/release/YVES/Sereal-Decoder-4.010/changes\", \"tags\": [\"release-notes\"]}], \"x_generator\": {\"engine\": \"cpansec-cna-tool 0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Sereal::Decoder versions from 4.000 through 4.009_002 for Perl is vulnerable to a buffer overwrite flaw in the Zstandard library.\\n\\nSereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1395\", \"description\": \"CWE-1395 Dependency on Vulnerable Third-Party Component\"}]}], \"providerMetadata\": {\"orgId\": \"9b29abf9-4ab0-4765-b253-1875cd9b441e\", \"shortName\": \"CPANSec\", \"dateUpdated\": \"2026-03-31T11:31:08.541Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-14030\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-31T14:18:55.221Z\", \"dateReserved\": \"2026-03-28T19:49:07.023Z\", \"assignerOrgId\": \"9b29abf9-4ab0-4765-b253-1875cd9b441e\", \"datePublished\": \"2026-03-31T11:31:08.541Z\", \"assignerShortName\": \"CPANSec\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.