CVE-2024-21907
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
A vulnerability in Newtonsoft.Json before version 13.0.1 involves mishandling of exceptional conditions. Crafted data passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception, leading to denial of service.
Risk Assessment
An unauthenticated remote attacker can cause the application using this library to crash, resulting in service disruption and potential financial loss or loss of customer trust.
Recommendation
Immediately update the Newtonsoft.Json library to version 13.0.1 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.