CVE-2024-14031 Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library
An attacker can exploit a race condition in the embedded Zstandard library to cause out-of-bounds writes, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-14031?
CVE-2024-14031 is a high-severity vulnerability in YVES Sereal::Encoder, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.
Sereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
Which versions are affected by CVE-2024-14031?
It affects 1 product.
Products include Yves Sereal\.
How do I fix CVE-2024-14031?
No fix has been published for CVE-2024-14031 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-14031 being exploited?
There is no known exploitation of CVE-2024-14031 in the wild and no public exploit code.
Other vulnerabilities in YVES Sereal::Encoder
Sources
Also known as GHSA-hhqv-q79g-jgfm.