CVE-2024-14030

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-14030
Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/advisories/GHSA-w77f-wv46-4vcx Not Applicable
https://metacpan.org/release/YVES/Sereal-Decoder-4.010/changes Release Notes
https://www.cve.org/CVERecord?id=CVE-2019-11922 Not Applicable
Configurations

Configuration 1 (hide)

cpe:2.3:a:yves:sereal\:\:decoder:*:*:*:*:*:perl:*:*
History

25 Jul 2026, 10:10

Type Values Removed Values Added
Summary
  • (es) Las versiones de Sereal::Decoder de 4.000 a 4.009_002 para Perl son vulnerables a una falla de sobrescritura de búfer en la biblioteca Zstandard. Sereal::Decoder incrusta una versión de la biblioteca Zstandard (zstd) que es vulnerable a CVE-2019-11922. Se trata de una condición de carrera en las funciones de compresión de una sola pasada de Zstandard anteriores a la versión 1.3.8 que podría permitir a un atacante escribir bytes fuera de los límites si se utilizara un búfer de salida más pequeño que el tamaño recomendado.

13 Apr 2026, 14:07

Type Values Removed Values Added
References () https://github.com/advisories/GHSA-w77f-wv46-4vcx - () https://github.com/advisories/GHSA-w77f-wv46-4vcx - Not Applicable
References () https://metacpan.org/release/YVES/Sereal-Decoder-4.010/changes - () https://metacpan.org/release/YVES/Sereal-Decoder-4.010/changes - Release Notes
References () https://www.cve.org/CVERecord?id=CVE-2019-11922 - () https://www.cve.org/CVERecord?id=CVE-2019-11922 - Not Applicable
First Time Yves
Yves sereal\
CWE CWE-787
CPE cpe:2.3:a:yves:sereal\:\:decoder:*:*:*:*:*:perl:*:*

01 Apr 2026, 17:16

Type Values Removed Values Added
Summary (en) Sereal::Decoder versions from 4.000 through 4.009_002 for Perl is vulnerable to a buffer overwrite flaw in the Zstandard library. Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used. (en) Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.

31 Mar 2026, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.1

31 Mar 2026, 12:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-31 12:16

Updated : 2026-07-25 10:10

NVD link : CVE-2024-14030

Mitre link : CVE-2024-14030

CVE.ORG link : CVE-2024-14030

JSON object : View

Products Affected

yves

  • sereal\
CWE
CWE-787

Out-of-bounds Write