{"id":"CVE-2024-14031","title":"Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\n\nSereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922","summary":"Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\n\nSereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race …","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-787"],"vendor":"yves","product":"sereal::encoder","affected":["sereal::encoder >= 4.000, < 4.010"],"patched":["sereal::encoder 4.010"],"published":"2026-03-31","updated":"2026-07-25","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-14031","references":[{"url":"https://github.com/advisories/GHSA-w77f-wv46-4vcx","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/YVES/Sereal-Encoder-4.010/changes","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11922","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"tags":["nvd"],"epss":0.00355,"epssPercentile":0.2917,"ingestedAt":"2026-07-25T10:53:53.042Z","slug":"CVE-2024-14031","body":"## Overview\n\nSereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\n\nSereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.\n\n## Affected\n\n- `sereal::encoder >= 4.000, < 4.010`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `sereal::encoder 4.010`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}