CVE-2024-14031

CVE-2024-14031: Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library

Vendor Yves

Product Sereal::Encoder

Weakness CWE-1395

Published March 31, 2026

Last update April 1, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.

Key dates

02Disclosure timeline

March 31, 2026 CVE published

April 1, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-14031 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1395.html

Related vulnerabilities

04Related CVE

CVE-2026-4176 Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib CVE-2024-38526 pdoc embeds link to malicious CDN if math mode is enabled CVE-2025-11159 Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component CVE-2024-0552 Intumit inc. SmartRobot - Remote Code Execution CVE-2024-21421 Azure SDK Spoofing Vulnerability