PT-2026-3907 · Seroval · Seroval

Lxsmnsyc + 1 · Publicado 2026-01-22 · Atualizado 2026-02-27 · CVE-2026-24006

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Seroval versions 1.4.0 and below

Description Seroval allows JavaScript value stringification, including complex structures beyond the capabilities of JSON.stringify. In versions 1.4.0 and below, serializing objects with significant depth can cause a maximum call stack limit error. Version 1.4.1 introduces a depthLimit parameter in serialization/deserialization methods, which throws an error if the depth limit is exceeded.

Recommendations Update to version 1.4.1 or later.

Exploit

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2026-24006

GHSA-3J22-8QJ3-26MX

Produtos afetados

Seroval

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24006.json · Exploit
• https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 · Correção
• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx · Aviso do Fabricante
• https://github.com/lxsmnsyc/seroval · Nota
• https://t.me/cveNotify/153491 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-24006 · Nota de Segurança
• https://t.me/CVEtracker/42735 · Publicação no Telegram
• https://twitter.com/_cvereports/status/2014664481855467536 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-3j22-8qj3-26mx · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-24006 · Aviso do Fabricante
• https://twitter.com/cracbot/status/2016103982989770993 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2014182481323540905 · Publicação no Twitter