CVE-2024-14030 Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library
A race condition in the embedded Zstandard library allows out-of-bounds writes, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-14030?
CVE-2024-14030 is a high-severity vulnerability in YVES Sereal::Decoder, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.
Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
Which versions are affected by CVE-2024-14030?
It affects 1 product.
Products include Yves Sereal\.
How do I fix CVE-2024-14030?
No fix has been published for CVE-2024-14030 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-14030 being exploited?
There is no known exploitation of CVE-2024-14030 in the wild and no public exploit code.
Other vulnerabilities in YVES Sereal::Decoder
Sources
Also known as GHSA-93rm-8cxm-wfv4.