Sereal::Decoder vulnerabilities

2 known vulnerabilities in Sereal::Decoder from YVES. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Sereal::Decoder: Out-of-bounds Read

  CVE-2026-8796May 31, 2026YVES

  Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input. In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash() process a COPY tag, a back-reference whose target byte the decoder re-decodes as a fresh tag. W

• 8.1 High severity

  Sereal::Decoder: Out-of-bounds Write

  CVE-2024-14030Mar 31, 2026YVES

  Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass