CVEvulnerability
CVE-2024-21907
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2024-01-03
- Last modified
- 2026-07-14
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-755
Description
Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.
Affected configurations
• newtonsoft json.net (< 13.0.1)
Related
Weakness · CWE (1)
- CWE-755 Improper Handling of Exceptional Conditions weakness
References
- https://alephsecurity.com/2018/10/22/StackOverflowException/ Exploit
- https://alephsecurity.com/vulns/aleph-2018004 Exploit
- https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66 Patch
- https://github.com/JamesNK/Newtonsoft.Json/issues/2457 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/JamesNK/Newtonsoft.Json/pull/2462 Patch
- https://github.com/advisories/GHSA-5crp-9r3c-p9vr Third Party Advisory
- https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678 Exploit, Third Party Advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vr Third Party Advisory
- https://alephsecurity.com/2018/10/22/StackOverflowException/ Exploit
- https://alephsecurity.com/vulns/aleph-2018004 Exploit
- https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66 Patch
- https://github.com/JamesNK/Newtonsoft.Json/issues/2457 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/JamesNK/Newtonsoft.Json/pull/2462 Patch
- https://github.com/advisories/GHSA-5crp-9r3c-p9vr Third Party Advisory
- https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678 Exploit, Third Party Advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vr Third Party Advisory