{"id":"CVE-2024-14030","summary":"Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library","details":"Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\n\nSereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","aliases":["CVE-2024-14031","GHSA-w77f-wv46-4vcx"],"modified":"2026-07-08T08:05:28.951914471Z","published":"2026-03-31T11:31:08.541Z","database_specific":{"cna_assigner":"CPANSec","cwe_ids":["CWE-1395"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/14xxx/CVE-2024-14030.json"},"references":[{"type":"WEB","url":"https://cpan.org/modules"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/14xxx/CVE-2024-14030.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w77f-wv46-4vcx"},{"type":"ADVISORY","url":"https://metacpan.org/release/YVES/Sereal-Decoder-4.010/changes"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-14030"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2019-11922"},{"type":"PACKAGE","url":"https://github.com/Sereal/Sereal"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sereal/sereal","events":[{"introduced":"0"},{"last_affected":"6bbf9a7f82678b2580532c1ded7ad578d355795d"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"4.000"},{"last_affected":"4.009_002"}]}}],"versions":["Sereal-Encoder-4.009_002","Sereal-Decoder-4.009_002","Sereal-4.009_002","Sereal-Encoder-4.009_001","Sereal-Decoder-4.009_001","Sereal-4.009_001","Sereal-Encoder-4.009","Sereal-Decoder-4.009","Sereal-4.009","Sereal-Encoder-4.008","Sereal-Decoder-4.008","Sereal-4.008","Sereal-Encoder-4.007_001","Sereal-Decoder-4.007_001","Sereal-4.007_001","v1.0","Python-Encoder-v1.0","Sereal-Encoder-4.007","Sereal-Decoder-4.007","Sereal-4.007","Sereal-Encoder-4.006","Sereal-Decoder-4.006","Sereal-4.006","Sereal-Encoder-4.005","Sereal-Decoder-4.005","Sereal-4.005","Sereal-Path-4.004","Sereal-Encoder-4.004","Sereal-Decoder-4.004","Sereal-4.004","Sereal-Encoder-4.003","Sereal-Decoder-4.003","Sereal-4.003","Sereal-Encoder-4.002","Sereal-Decoder-4.002","Sereal-4.002","Sereal-Path-4.003","Sereal-Path-4.002","Sereal-Path-4.001_004","Sereal-Encoder-4.001_003","Sereal-Decoder-4.001_003","Sereal-4.001_003","Sereal-Encoder-4.001_002","Sereal-Decoder-4.001_002","Sereal-4.001_002","Sereal-Path-4.001_002","Sereal-Path-4.001_001","Sereal-Path-0.014","Sereal-Encoder-4.001_001","Sereal-Decoder-4.001_001","Sereal-4.001_001","Sereal-Encoder-3.015","Sereal-Decoder-3.015","Sereal-3.015","Sereal-Encoder-3.014_002","Sereal-Decoder-3.014_002","Sereal-3.014_002","Sereal-Encoder-3.014_001","Sereal-Decoder-3.014_001","Sereal-3.014_001","Sereal-Path-0.013","Sereal-Encoder-3.014","Sereal-Decoder-3.014","Sereal-3.014","Sereal-Encoder-3.012","Sereal-Decoder-3.012","Sereal-3.012","Sereal-Encoder-3.011","Sereal-Decoder-3.011","Sereal-3.011","Sereal-Encoder-3.010","Sereal-Decoder-3.010","Sereal-3.010","Sereal-Encoder-3.009","Sereal-Decoder-3.009","Sereal-3.009","Sereal-Encoder-3.008","Sereal-Decoder-3.008","Sereal-3.008","Sereal-Encoder-3.007","Sereal-Decoder-3.007","Sereal-3.007","Sereal-Encoder-3.006_007","Sereal-Decoder-3.006_007","Sereal-3.006_007","Sereal-Encoder-3.006_006","Sereal-Decoder-3.006_006","Sereal-3.006_006","Sereal-Encoder-3.006_005","Sereal-Decoder-3.006_005","Sereal-3.006_005","Sereal-Encoder-3.006_004","Sereal-Decoder-3.006_004","Sereal-3.006_004","Sereal-Encoder-3.006_003","Sereal-Decoder-3.006_003","Sereal-3.006_003","Sereal-Encoder-3.006_002","Sereal-Decoder-3.006_002","Sereal-3.006_002","Sereal-Encoder-3.006_001","Sereal-Decoder-3.006_001","Sereal-3.006_001","Sereal-Encoder-3.006","Sereal-Decoder-3.006","Sereal-3.006","Sereal-Encoder-3.005_005","Sereal-Decoder-3.005_005","Sereal-3.005_005","Sereal-Encoder-3.005_004","Sereal-Decoder-3.005_004","Sereal-3.005_004","Sereal-Encoder-3.005_003","Sereal-Decoder-3.005_003","Sereal-3.005_003","Sereal-Path-0.011","Sereal-Encoder-3.005_002","Sereal-Decoder-3.005_002","Sereal-3.005_002","Sereal-Path-0.010","Sereal-Path-0.009","Sereal-Path-0.008","Sereal-Path-0.007","Sereal-Path-0.004","Sereal-Path-0.003","Sereal-Path-0.002","Sereal-Path-0.001","Sereal-Merger-0.001","Sereal-Encoder-3.005_001","Sereal-Decoder-3.005_001","Sereal-3.005_001","Sereal-Encoder-3.005","Sereal-Decoder-3.005","Sereal-3.005","Sereal-Encoder-3.004","Sereal-Decoder-3.004","Sereal-3.004","Sereal-Encoder-3.003_004","Sereal-Decoder-3.003_004","Sereal-3.003_004","Sereal-Encoder-3.003_003","Sereal-Decoder-3.003_003","Sereal-3.003_003","Sereal-Encoder-3.003_002","Sereal-Decoder-3.003_002","Sereal-3.003_002","Sereal-Encoder-3.003_001","Sereal-Decoder-3.003_001","Sereal-3.003_001","Sereal-Encoder-3.003","Sereal-Decoder-3.003","Sereal-3.003","Sereal-Encoder-3.002_002","Sereal-Decoder-3.002_002","Sereal-3.002_002","Sereal-Encoder-3.002_001","Sereal-Decoder-3.002_001","Sereal-3.002_001","Sereal-Encoder-3.002","Sereal-Decoder-3.002","Sereal-3.002","Sereal-Encoder-3.001_012","Sereal-Decoder-3.001_012","Sereal-3.001_012","Sereal-Encoder-3.001_011","Sereal-Decoder-3.001_011","Sereal-3.001_011","Sereal-Encoder-3.001_009","Sereal-Decoder-3.001_009","Sereal-3.001_009","Sereal-Encoder-3.001_008","Sereal-Decoder-3.001_008","Sereal-3.001_008","Sereal-Encoder-3.001_007","Sereal-Decoder-3.001_007","Sereal-3.001_007","Sereal-Encoder-3.001_006","Sereal-Decoder-3.001_006","Sereal-3.001_006","Sereal-Encoder-3.001_005","Sereal-Decoder-3.001_005","Sereal-3.001_005","Sereal-Encoder-3.001_004","Sereal-Decoder-3.001_004","Sereal-3.001_004","Sereal-Encoder-3.001_003","Sereal-Decoder-3.001_003","Sereal-3.001_003","Sereal-Encoder-3.001_002","Sereal-Decoder-3.001_002","Sereal-3.001_002","Sereal-Encoder-3.001_001","Sereal-Decoder-3.001_001","Sereal-3.001_001","Sereal-Encoder-3.001","Sereal-Decoder-3.001","Sereal-3.001","Sereal-Encoder-3.000_004","Sereal-Decoder-3.000_004","Sereal-3.000_004","Sereal-Encoder-3.000_003","Sereal-Decoder-3.000_003","Sereal-3.000_003","Sereal-Encoder-3.000_002","Sereal-Decoder-3.000_002","Sereal-3.000_002","Sereal-Encoder-3.000_001","Sereal-Decoder-3.000_001","Sereal-3.000_001","Sereal-Encoder-2.12","Sereal-Decoder-2.12","Sereal-2.12","Sereal-Encoder-2.11","Sereal-Decoder-2.11","Sereal-2.11","Sereal-Encoder-2.10","Sereal-Decoder-2.10","Sereal-2.10","Sereal-Encoder-2.09","Sereal-Decoder-2.09","Sereal-2.09","Sereal-Encoder-2.08","Sereal-Decoder-2.08","Sereal-2.08","Sereal-Encoder-2.070_103","Sereal-Decoder-2.070_103","Sereal-2.070_103","Sereal-Encoder-2.070_102","Sereal-Decoder-2.070_102","Sereal-2.070_102","Sereal-Encoder-2.070_101","Sereal-Decoder-2.070_101","Sereal-2.070_101","Sereal-Encoder-2.07_01","Sereal-Decoder-2.07_01","Sereal-2.060","Sereal-Encoder-2.06","Sereal-Decoder-2.06","Sereal-Encoder-2.04","Sereal-Decoder-2.04","Sereal-2.040","Sereal-2.030","Sereal-Encoder-2.03","Sereal-Decoder-2.03","Sereal-2.020","Sereal-Encoder-2.02","Sereal-Decoder-2.02","Sereal-2.011","Sereal-Encoder-2.01","Sereal-Decoder-2.01","Sereal-2.010","Sereal-Encoder-2.00_03","Sereal-Decoder-2.00_03","Sereal-Encoder-2.00_02","Sereal-Decoder-2.00_02","Sereal-Encoder-2.00_01","Sereal-Decoder-2.00_01","Sereal-Encoder-0.36","Sereal-Decoder-0.36","Sereal-0.360","Sereal-Encoder-0.35","Sereal-Decoder-0.35","Sereal-0.350","Sereal-Encoder-0.34","Sereal-Decoder-0.34","Sereal-0.340","Sereal-Encoder-0.33","Sereal-Decoder-0.33","Sereal-0.330","Sereal-Encoder-0.32","Sereal-Decoder-0.32","Sereal-0.320","Sereal-Encoder-0.31","Sereal-Decoder-0.31","Sereal-0.310","Sereal-Encoder-0.30","Sereal-Decoder-0.30","Sereal-0.300","Sereal-Encoder-0.29","Sereal-Decoder-0.29","Sereal-0.290","Sereal-Encoder-0.28","Sereal-Decoder-0.28","Sereal-0.280","Sereal-Encoder-0.27","Sereal-Decoder-0.27","Sereal-0.270","Sereal-0.260","Sereal-Encoder-0.26","Sereal-Encoder-0.25","Sereal-Decoder-0.25","Sereal-0.250","Sereal-Decoder-0.24","Sereal-0.230","Sereal-Encoder-0.23","Sereal-Decoder-0.23","Sereal-0.210","Sereal-Decoder-0.21","Sereal-0.201","Sereal-0.20","Sereal-Encoder-0.20","Sereal-Decoder-0.19","Sereal-Encoder-0.18","Sereal-Encoder-0.17","Sereal-Encoder-0.16","Sereal-Encoder-0.15","Sereal-Decoder-0.15","Sereal-Encoder-0.14","Sereal-Decoder-0.13","Sereal-Encoder-0.12","Sereal-Encoder-0.11","Sereal-Decoder-0.11","Sereal-Encoder-0.10","Sereal-Decoder-0.10","Sereal-Encoder-0.09","Sereal-Decoder-0.09","Sereal-Encoder-0.08","Sereal-Decoder-0.08","Sereal-Encoder-0.07","Sereal-Decoder-0.07","Sereal-Encoder-0.06","Sereal-Decoder-0.06","Sereal-Encoder-0.05","Sereal-Decoder-0.05","Sereal-Encoder-0.04","Sereal-Decoder-0.04","Sereal-Encoder-0.03","Sereal-Decoder-0.03","Sereal-Encoder-0.02","Sereal-Decoder-0.02","Sereal-Encoder-0.01","Sereal-Decoder-0.01"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-14030.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}