High severity8.1NVD Advisory· Published Mar 31, 2026· Updated Apr 13, 2026

CVE-2024-14030

Description

Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.

Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Yves/Sereal\
cpe:2.3:a:yves:sereal\:\:decoder:*:*:*:*:*:perl:*:*
Range: >=4.000,<4.010
Zstandard/Zstandardllm-create
Range: <1.3.8
Sereal::Encoder/Sereal::Encoderllm-fuzzy
Range: 4.000 - 4.009_002

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-w77f-wv46-4vcxnvdNot Applicable
metacpan.org/release/YVES/Sereal-Decoder-4.010/changesnvdRelease Notes
www.cve.org/CVERecordnvdNot Applicable

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000