CVE-2024-58264
serde-json-wasm stack overflow during recursive JSON parsing
The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.
- Record
CVE-2024-58264- CVSS 3.1
- 3.2 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-674
- Updated
- 2026-11-02
EUVDEUVD-2024-54825
The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.
- Record
EUVD-2024-54825- CVSS 3.1
- 3.2 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rr69-rxr6-8qwf
serde-json-wasm stack overflow during recursive JSON parsing
When parsing untrusted, deeply nested JSON, the stack may overflow, possibly enabling a Denial of Service attack. This was fixed by adding a check for recursion depth.
- Record
GHSA-rr69-rxr6-8qwf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.
- Record
CVE-2024-58264- CVSS 3.1
- 3.2 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674, CWE-787
- Updated
- 2026-11-02
OSVGHSA-rr69-rxr6-8qwf
serde-json-wasm stack overflow during recursive JSON parsing
When parsing untrusted, deeply nested JSON, the stack may overflow, possibly enabling a Denial of Service attack. This was fixed by adding a check for recursion depth.
- Record
GHSA-rr69-rxr6-8qwf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRUSTSEC-2024-0012 No score
Stack overflow during recursive JSON parsing
When parsing untrusted, deeply nested JSON, the stack may overflow, possibly enabling a Denial of Service attack. This was fixed by adding a check for recursion depth.
- Record
RUSTSEC-2024-0012- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
serde-json-wasmcrates.io |
1.0.0 to 1.0.0 | 1.0.1 |
serde-json-wasmcrates.io |
before 0.5.2 | 0.5.2 |
serde-json-wasmcrates.io |
1.0.0 up to 1.0.1 | 1.0.1 |
serde-json-wasmcrates.io |
0.0.0-0 up to 0.5.2, 1.0.0 up to 1.0.1 | 0.5.21.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-58264 is a low vulnerability (CVSS 3.2) in Cosmwasm Serde-json-wasm, published January 24, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in serde-json-wasm 1.0.1.
References
rustsec.org/advisories/RUSTSEC-2024-0012.html
github.com/advisories/GHSA-rr69-rxr6-8qwf
crates.io/crates/serde-json-wasm
nvd.nist.gov/vuln/detail/CVE-2024-58264