CVE-2026-23957CWE-770

seroval is vulnerable to Denial of Service via array serialization

High · published January 22, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
37.1
In the wild
Unconfirmed
What it is

⚡ A single oversized array value can crank your server’s processing time into overdrive! This means a simple input could cause significant slowdowns for users. 🚀 Think of it like a restaurant kitchen where one chef keeps sending back orders with an extra zero on the ticket — suddenly, your staff is overwhelmed making too many dishes at once, slowing down the whole operation! An attacker can exploit this flaw to overload the server, leading to delays that could cripple application responsiveness — a frustrating experience for users waiting for their data! If left unaddressed, this could frustrate users and even lead to service outages. 😱

Put simply

Think of it like a restaurant kitchen where one chef keeps sending back orders with an extra zero on the ticket — suddenly, your staff is overwhelmed making too many dishes at once, slowing down the whole operation! This vulnerability in seroval allows attackers to cause a denial of service by sending excessively large values for encoded array lengths during the deserialization process, resulting in increased processing times.

What to do

An attacker can exploit this flaw to overload the server, leading to delays that could cripple application responsiveness — a frustrating experience for users waiting for their data! If left unaddressed, this could frustrate users and even lead to service outages. 😱 Immediate action required: Upgrade to version 1.4.1 to patch this vulnerability. Additionally, conduct an audit of your input handling to ensure it can appropriately manage unexpected input sizes. You've got this! Just follow these steps, and you'll have your server running smoothly in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00439 · 37.1th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-01-22T01:26Z
EPSS history
Timeline
  • 22 JAN 01:26Z
    seroval is vulnerable to Denial of Service via array serialization
    cvelistv5