Newtonsoft · Newtonsoft.Json · CVE-2024-21907
**Name of the Vulnerable Software and Affected Versions**
Newtonsoft.Json versions prior to 13.0.1
**Description**
The issue is related to a mishandling of exceptional conditions vulnerability in the Newtonsoft.Json library. Crafted data passed to the `JsonConvert.DeserializeObject` method may trigger a StackOverflow exception, resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition. The vulnerability can be exploited by passing highly nested JSON data, which can cause high CPU and RAM usage or a StackOverflow exception.
**Recommendations**
To mitigate the issue, update Newtonsoft.Json to version 13.0.1 or set the `MaxDepth` parameter in the `JsonSerializerSettings` to a suitable value, such as 128, to prevent excessive nesting. This can be done globally with the following statement:
`JsonConvert.DefaultSettings = () => new JsonSerializerSettings { MaxDepth = 128 };`