Title: Sereal::Decoder de YVES, Description: Las versiones de Sereal::Decoder de 4.000 a 4.009_002 para Perl son vulnerables a una falla de sobrescritura de búfer en la biblioteca Zstandard.

Sereal::Decoder incrusta una versión de la biblioteca Zstandard (zstd) que es vulnerable a CVE-2019-11922. Se trata de una condición de carrera en las funciones de compresión de una sola pasada de Zstandard anteriores a la versión 1.3.8 que podría permitir a un atacante escribir bytes fuera de los límites si se utilizara un búfer de salida más pequeño que el tamaño recomendado.

{"timestamp":"2026-03-31T14:18:18.323057Z","id":"CVE-2024-14030","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"YVES","product":"Sereal::Decoder","defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"Sereal-Decoder","repo":"https://github.com/Sereal/Sereal","versions":[{"version":"4.000","lessThanOrEqual":"4.009_002","versionType":"custom","status":"affected"}]}]

CWE-787

OR
          *cpe:2.3:a:yves:sereal::decoder:*:*:*:*:*:perl:*:* versions from (including) 4.000 up to (excluding) 4.010

CPANSec: https://github.com/advisories/GHSA-w77f-wv46-4vcx Types: Not Applicable

CPANSec: https://metacpan.org/release/YVES/Sereal-Decoder-4.010/changes Types: Release Notes

CPANSec: https://www.cve.org/CVERecord?id=CVE-2019-11922 Types: Not Applicable

Sereal::Decoder versions from 4.000 through 4.009_002 for Perl is vulnerable to a buffer overwrite flaw in the Zstandard library.

Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.

Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.

Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Sereal::Decoder versions from 4.000 through 4.009_002 for Perl is vulnerable to a buffer overwrite flaw in the Zstandard library.

Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.  This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.

https://github.com/advisories/GHSA-w77f-wv46-4vcx

https://metacpan.org/release/YVES/Sereal-Decoder-4.010/changes

https://www.cve.org/CVERecord?id=CVE-2019-11922