CVE-2024-14031CWE-1395

Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library

High · published March 31, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
28.0
In the wild
Unconfirmed
What it is

Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.

Sereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00355 · 28.0th percentile
Weakness
CWE-1395 · Dependency on Vulnerable Third-Party Component
Published
2026-03-31T11:31Z
EPSS history
Timeline
  • 31 MAR 11:31Z
    Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library
    cvelistv5