CVE-2024-21907

🗓️ 03 Jan 2024 15:23:04Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 293 Views🌐 WEB

Newtonsoft.Json before version 13.0.1 mishandles exceptional conditions, allowing for denial of service via crafted data

Reporter	Title	Published	Views	Family All 35
GithubExploit	Exploit for Improper Handling of Exceptional Conditions in Newtonsoft Json.Net	15 May 202621:41	–	githubexploit
Information Security Automation	September Microsoft Patch Tuesday	9 Sep 202520:48	–	avleonov
BDU FSTEC	The vulnerability of the JsonConvert.DeserializeObject method in the .NET Json.NET framework allows a attacker to cause a service failure.	6 Nov 202400:00	–	bdu_fstec
Circl	CVE-2024-21907	3 Jan 202417:26	–	circl
CNNVD	Json.NET Security Vulnerabilities	3 Jan 202400:00	–	cnnvd
Cvelist	CVE-2024-21907 Improper Handling of Exceptional Conditions in Newtonsoft.Json	3 Jan 202415:23	–	cvelist
IBM Security Bulletins	Security Bulletin: IBM MaaS360 Cloud Extender Agent, Configuration Utility and Mobile Enterprise Gateway (MEG) affected by multiple vulnerabilities (CVE-2024-21907, CVE-2023-39017, CVE-2024-40642, CVE-2015-2325)	15 Apr 202503:55	–	ibm
Github Security Blog	Improper Handling of Exceptional Conditions in Newtonsoft.Json	22 Jun 202215:08	–	github
Github Security Blog	Duplicate Advisory: Improper Handling of Exceptional Conditions in Newtonsoft.Json	3 Jan 202418:30	–	github
Microsoft KB	KB5065222 - Description of the security update for SQL Server 2019 CU32: September 9, 2025	9 Sep 202507:00	–	mskb

NVD

CNA

Node

newtonsoft json.netRange<13.0.1

[
  {
    "collectionURL": "https://nuget.org/packages",
    "defaultStatus": "unaffected",
    "packageURL": "pkg:nuget/Newtonsoft.Json",
    "packageName": "Newtonsoft.Json",
    "versions": [
      {
        "lessThan": "13.0.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver 2.0.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66
alephsecurity	www.alephsecurity.com/vulns/aleph-2018004
github	www.github.com/JamesNK/Newtonsoft.Json/pull/2462
alephsecurity	www.alephsecurity.com/2018/10/22/StackOverflowException/
vulncheck	www.vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vr
github	www.github.com/JamesNK/Newtonsoft.Json/issues/2457
github	www.github.com/advisories/GHSA-5crp-9r3c-p9vr
security	www.security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678

Parameter	Position	Path	Description	CWE
name	request body	/payload.json	Exploits deeply nested JSON input deserialization via JsonConvert.DeserializeObject, triggering stack overflow (Denial of Service) when the input is a URL to a nested payload.	CWE-755

14 Jul 2026 23:17Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.5

EPSS0.32908

SSVC

CWE-755