CVE-2024-14030 in YVES Sereal::Decoder
要約 (英語)
Sereal::Decoder versions from 4.000 through 4.009_002 for Perl is vulnerable to a buffer overwrite flaw in the Zstandard library. Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
責任者
CPANSec
予約する
2026年03月28日
公開
2026年03月31日
エントリ
VulDB provides additional information and datapoints for this CVE:
| 識別子 | 脆弱性 | CWE | 悪用可 | 対策 | CVE |
|---|---|---|---|---|---|
| 354364 | YVES Sereal::Decoder Compression リモートコード実行 | 1395 | 未定義 | 未定義 | CVE-2024-14030 |