{"id":"CVE-2024-58264","aliases":["EUVD-2024-54825","GHSA-rr69-rxr6-8qwf","RUSTSEC-2024-0012"],"status":"published","title":"serde-json-wasm stack overflow during recursive JSON parsing","description":"The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.","severity":{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00547,"percentile":0.46116,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674","CWE-787"],"published":"2024-01-24T12:00:00Z","modified":"2026-06-17T08:14:44Z","fixes":[{"ecosystem":"crates.io","package":"serde-json-wasm","fixed_in":["1.0.1","0.5.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"serde-json-wasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"1.0.0"},{"fixed":"1.0.1"}]}],"versions":["1.0.0"]},{"source":"ghsa","ecosystem":"crates.io","package":"serde-json-wasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"serde-json-wasm","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}],"versions":["1.0.0"]},{"source":"osv","ecosystem":"crates.io","package":"serde-json-wasm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"serde-json-wasm","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.5.2"},{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}]}],"products":[{"vendor":"cosmwasm","product":"serde-json-wasm"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0012.html","tags":["Third Party Advisory","web","advisory"]},{"url":"https://github.com/advisories/GHSA-rr69-rxr6-8qwf","tags":["Third Party Advisory"]},{"url":"https://crates.io/crates/serde-json-wasm","tags":["Product","package"]},{"url":"https://github.com/CosmWasm/serde-json-wasm/commit/a9a9b9bf243862bd2afbf6853fca97f30dc4f620","tags":["web"]},{"url":"https://github.com/CosmWasm/serde-json-wasm/commit/e78f9e28b3a2151d3175ee88ab2a001bf9515429","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58264","tags":["advisory"]},{"url":"https://github.com/CosmWasm/serde-json-wasm","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-58264","description":"The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.","status":"published","published":"2025-07-27T00:00:00Z","modified":"2025-07-28T15:06:17.073Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:34:08.843708Z"}],"euvd":[{"id":"EUVD-2024-54825","description":"The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.","status":"published","published":"2025-07-27T00:00:00Z","modified":"2025-07-28T15:06:17Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T20:32:03.907132Z"}],"ghsa":[{"id":"GHSA-rr69-rxr6-8qwf","title":"serde-json-wasm stack overflow during recursive JSON parsing","description":"When parsing untrusted, deeply nested JSON, the stack may overflow, possibly enabling a Denial of Service attack. This was fixed by adding a check for recursion depth.","status":"published","published":"2024-02-09T16:03:32Z","modified":"2025-07-28T15:55:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:38:51.864708Z"}],"nvd":[{"id":"CVE-2024-58264","description":"The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.","status":"published","published":"2025-07-27T21:15:26.453Z","modified":"2026-06-17T08:14:44.36Z","cvss":[{"version":"3.1","score":3.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-674","CWE-787"],"updated_at":"2026-11-02T14:10:47.073504Z"}],"osv":[{"id":"GHSA-rr69-rxr6-8qwf","title":"serde-json-wasm stack overflow during recursive JSON parsing","description":"When parsing untrusted, deeply nested JSON, the stack may overflow, possibly enabling a Denial of Service attack. This was fixed by adding a check for recursion depth.","status":"published","published":"2024-02-09T16:03:32Z","modified":"2025-07-28T16:27:07.678146Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"RUSTSEC-2024-0012","title":"Stack overflow during recursive JSON parsing","description":"When parsing untrusted, deeply nested JSON, the stack may overflow,\npossibly enabling a Denial of Service attack.\nThis was fixed by adding a check for recursion depth.","status":"published","published":"2024-01-24T12:00:00Z","modified":"2025-10-28T06:02:18Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}