CVE-2024-14030

Name of the Vulnerable Software and Affected Versions Sereal::Decoder versions 4.000 through 4.009 002

Description Sereal::Decoder embeds a version of the Zstandard (zstd) library containing a race condition in its one-pass compression functions. This flaw allows an attacker to write bytes out of bounds if an output buffer smaller than the recommended size is used. A race condition is a situation where the behavior of software depends on the relative timing of events, such as the order in which threads are scheduled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.