CVE catalog
CVE-2024-14030
Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerabl
- Severity
- High · CVSS 8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.36% · Oct 25, 2026
Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libsereal-encoder-perl | sid | 5.011+ds-1 | not affected |
| Debian | libsereal-encoder-perl | forky | 5.011+ds-1 | not affected |
| Debian | libsereal-encoder-perl | trixie | 5.004+ds-1 | not affected |
| Debian | libsereal-encoder-perl | bookworm | 5.003+ds-1 | not affected |
| Cpe | sereal\ | Not reported | 4.010 | fixed |
| Cpe | libsereal-encoder-perl | Not reported | Not reported | not affected |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libsereal-encoder-perl | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | libsereal-encoder-perl | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | libsereal-encoder-perl | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | libsereal-encoder-perl | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Cpe | sereal\ | cpe | Not reported | 4.010 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libsereal-encoder-perl]Not affected
Details (2)
5.003+ds-1· amd64 · bookwormNot affected
nvd · libsereal-encoder-perl · debian · bookworm
5.003+ds-1· arm64 · bookwormNot affected
nvd · libsereal-encoder-perl · debian · bookworm
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2024-14030]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2024-14030]
- [https://security-tracker.debian.org/tracker/CVE-2024-14030]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-14030.json]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]