Executive brief
Sereal::Encoder is a Perl library used for high-performance data serialization and compression. A security flaw in an embedded third-party component could allow an attacker to cause a system crash or potentially execute unauthorized code when the library processes specially crafted data. This could lead to service outages or the compromise of sensitive information handled by the application.
Technical details
Sereal::Encoder versions 4.000 through 4.009_002 embed a version of the Zstandard (zstd) library (prior to 1.3.8) that is vulnerable to a race condition (CVE-2019-11922). The flaw exists in the one-pass compression functions and can be triggered if an output buffer smaller than the recommended size is utilized. An attacker could exploit this race condition to perform an out-of-bounds write, potentially leading to memory corruption, denial of service, or remote code execution. The vulnerability is reachable over the network with high attack complexity and no required user authentication. The issue is addressed in Sereal::Encoder version 4.010.
Affected products
- YVES Sereal::Encoder 4.000 - 4.009_002
Timeline
- 2026-03-31: disclosed: Initial publication of CVE-2024-14031
- 2026-03-31: advisory
- 2026-04-13: other: NIST initial analysis completed