{"id":"CVE-2024-14031","aliases":["EUVD-2024-55512","GHSA-hhqv-q79g-jgfm","GHSA-w77f-wv46-4vcx","UBUNTU-CVE-2024-14031"],"status":"published","title":"Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library","description":"Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\n\nSereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00361,"percentile":0.30122,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1395","CWE-787"],"published":"2026-03-31T11:31:08.541Z","modified":"2026-10-28T02:31:14Z","products":[{"vendor":"yves","product":"sereal::encoder"},{"vendor":"yves","product":"sereal\\"}],"references":[{"url":"https://github.com/advisories/GHSA-w77f-wv46-4vcx","tags":["vendor-advisory","Not Applicable","advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11922","tags":["vendor-advisory","Not Applicable","advisory"]},{"url":"https://metacpan.org/release/YVES/Sereal-Encoder-4.010/changes","tags":["release-notes","Release Notes","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-14031","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hhqv-q79g-jgfm"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/14xxx/CVE-2024-14030.json","tags":["advisory"]},{"url":"https://metacpan.org/release/YVES/Sereal-Decoder-4.010/changes","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-14030","tags":["advisory"]},{"url":"https://github.com/Sereal/Sereal","tags":["package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/14xxx/CVE-2024-14031.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-14031","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-14031","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/38450207/","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-14031","title":"Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library","description":"Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\n\nSereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2026-03-31T11:31:28.1Z","modified":"2026-04-01T16:30:00.649Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-1395","CWE-1395"],"updated_at":"2026-11-02T14:33:59.884489Z"}],"euvd":[{"id":"EUVD-2024-55512","description":"Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\n\nSereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2026-03-31T11:31:28Z","modified":"2026-04-01T16:30:00Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:25:24.09733Z"}],"ghsa":[{"id":"GHSA-hhqv-q79g-jgfm","title":"Sereal::Encoder versions from 4.000 through 4.009_002 for Perl is vulnerable to a buffer...","description":"Sereal::Encoder versions from 4.000 through 4.009_002 for Perl is vulnerable to a buffer overwrite flaw in the Zstandard library.\n\nSereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2026-03-31T12:31:35Z","modified":"2026-04-13T15:32:09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:07:26.169567Z"}],"nvd":[{"id":"CVE-2024-14031","description":"Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\n\nSereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2026-03-31T12:16:26.31Z","modified":"2026-07-25T10:10:00.167Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:10:47.77313Z"}],"osv":[{"id":"CVE-2024-14030","title":"Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library","description":"Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\n\nSereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2026-03-31T11:31:08.541Z","modified":"2026-10-28T02:31:14.838560957Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"CVE-2024-14031","title":"Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library","description":"Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.\n\nSereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.","status":"published","published":"2026-03-31T11:31:28.1Z","modified":"2026-10-28T02:30:46.849077632Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"UBUNTU-CVE-2024-14031","description":"[Unknown description]","status":"withdrawn","published":"2026-04-01T00:00:00Z","modified":"2026-04-13T11:53:01.870313Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:41.555387Z"}]}}