---
id: CVE-2024-14031
title: >-
  Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a
  vulnerable version of the Zstandard library.


  Sereal::Encoder embeds a version of the Zstandard (zstd) library that is
  vulnerable to CVE-2019-11922
summary: >-
  Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a
  vulnerable version of the Zstandard library.


  Sereal::Encoder embeds a version of the Zstandard (zstd) library that is
  vulnerable to CVE-2019-11922.  This is a race …
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-787
vendor: yves
product: 'sereal::encoder'
affected:
  - 'sereal::encoder >= 4.000, < 4.010'
patched:
  - 'sereal::encoder 4.010'
published: '2026-03-31'
updated: '2026-07-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-14031'
references:
  - url: 'https://github.com/advisories/GHSA-w77f-wv46-4vcx'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://metacpan.org/release/YVES/Sereal-Encoder-4.010/changes'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://www.cve.org/CVERecord?id=CVE-2019-11922'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
tags:
  - nvd
epss: 0.00355
epssPercentile: 0.2917
ingestedAt: '2026-07-25T10:53:53.042Z'
---

## Overview

Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.

Sereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.

## Affected

- `sereal::encoder >= 4.000, < 4.010`

## Remediation

Upgrade past the affected range:

- `sereal::encoder 4.010`