Skip to main content

Improper Handling of Exceptional Conditions in Newtonsoft.Json

CVE-2024-21907

  • Newtonsoft.Json
  • Newtonsoft.Json.Akshay
  • Newtonsoft.Json.dll
  • Newtonsoft.Json.Extended
  • Newtonsoft.Json.Legacy
  • Newtonsoft.Json.NetCore
  • Newtonsoft.Json.NoBrowser
  • Newtonsoft.Json.Test
High
7.5/10

Summary

Newtonsoft.Json prior to version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the "JsonConvert.DeserializeObject" method may trigger a StackOverflow exception resulting in Denial of Service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-755 - Improper Handling of Exceptional Conditions

The software does not handle or incorrectly handles an exceptional condition.

References

Advisory Timeline

  • Published