---
id: CVE-2024-21907
title: >-
  Newtonsoft.Json before version 13.0.1 is affected by a mishandling of
  exceptional conditions vulnerability
summary: >-
  Newtonsoft.Json before version 13.0.1 is affected by a mishandling of
  exceptional conditions vulnerability. Crafted data that is passed to the
  JsonConvert.DeserializeObject method may trigger a StackOverflow exception
  resulting in denial…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-755
  - CWE-755
vendor: newtonsoft
product: json.net
affected:
  - json.net < 13.0.1
patched:
  - json.net 13.0.1
published: '2024-01-03'
updated: '2026-07-14'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-21907'
references:
  - url: 'https://alephsecurity.com/2018/10/22/StackOverflowException/'
    label: disclosure@vulncheck.com
  - url: 'https://alephsecurity.com/vulns/aleph-2018004'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66
    label: disclosure@vulncheck.com
  - url: 'https://github.com/JamesNK/Newtonsoft.Json/issues/2457'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/JamesNK/Newtonsoft.Json/pull/2462'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/advisories/GHSA-5crp-9r3c-p9vr'
    label: disclosure@vulncheck.com
  - url: 'https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678'
    label: disclosure@vulncheck.com
  - url: 'https://vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vr'
    label: disclosure@vulncheck.com
  - url: 'https://alephsecurity.com/2018/10/22/StackOverflowException/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://alephsecurity.com/vulns/aleph-2018004'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/JamesNK/Newtonsoft.Json/issues/2457'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/JamesNK/Newtonsoft.Json/pull/2462'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/advisories/GHSA-5crp-9r3c-p9vr'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vr'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - exploit-available
epss: 0.32908
epssPercentile: 0.98302
ingestedAt: '2026-07-14T23:40:04.455Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/iSecurityTW/seal-security-nuget-demo-net7'
  checkedAt: '2026-09-26T09:05:30.883Z'
exploitAvailable: true
---

## Overview

Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

## Affected

- `json.net < 13.0.1`

## Remediation

Upgrade past the affected range:

- `json.net 13.0.1`