CVE-2024-21907

2024-01-0316:15:08

CWE-755

VulnCheck

web.nvd.nist.gov

newtonsoft.json

cve-2024-21907

exceptional conditions

denial of service

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.003

Percentile

69.8%

JSON

Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

Affected configurations

Nvd

Node

newtonsoftjson.netRange<13.0.1

VendorProductVersionCPE
newtonsoftjson.net*cpe:2.3:a:newtonsoft:json.net:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
newtonsoft	json.net	*	cpe:2.3:a:newtonsoft:json.net::::::::

CNA Affected

[
  {
    "collectionURL": "https://nuget.org/packages",
    "defaultStatus": "unaffected",
    "packageName": "Newtonsoft.Json",
    "versions": [
      {
        "lessThan": "13.0.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver 2.0.0"
      }
    ]
  }
]