PT-2025-31022 · Pypi · Serde-Json-Wasm

Published 2024-01-24 · Updated 2025-07-27 · CVE-2024-58264

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions serde-json-wasm versions prior to 1.0.1

Description The serde-json-wasm crate is susceptible to a stack consumption issue when processing deeply nested JSON data.

Recommendations Update to version 1.0.1 or later.

Fix

Uncontrolled Recursion

Memory Corruption

Weakness Enumeration

CWE-674

CWE-787

Related Identifiers

CVE-2024-58264

GHSA-J87P-GJR6-M4PV

GHSA-RR69-RXR6-8QWF

RUSTSEC-2024-0012

Affected Products

Serde-Json-Wasm

References · 13

• https://osv.dev/vulnerability/GHSA-j87p-gjr6-m4pv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rr69-rxr6-8qwf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58264 · Security Note
• https://osv.dev/vulnerability/CVE-2024-58264 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2024-0012 · Vendor Advisory
• https://github.com/CosmWasm/serde-json-wasm · Note
• https://github.com/CosmWasm/serde-json-wasm/commit/e78f9e28b3a2151d3175ee88ab2a001bf9515429 · Note
• https://github.com/CosmWasm/serde-json-wasm/commit/a9a9b9bf243862bd2afbf6853fca97f30dc4f620 · Note
• https://rustsec.org/advisories/RUSTSEC-2024-0012.html · Note
• https://crates.io/crates/serde-json-wasm · Note
• https://github.com/advisories/GHSA-rr69-rxr6-8qwf · Note
• https://twitter.com/CVEnew/status/1949579373507494097 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1949588462589387260 · Twitter Post