CVE-2024-21907

7.5 HIGH
Published: January 03, 2024 Modified: November 28, 2025
View on NVD

Description

Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://alephsecurity.com/2018/10/22/StackOverflowException/
Source: disclosure@vulncheck.com
Exploit
https://alephsecurity.com/vulns/aleph-2018004
Source: disclosure@vulncheck.com
Exploit
https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66
Source: disclosure@vulncheck.com
Patch
https://github.com/JamesNK/Newtonsoft.Json/issues/2457
Source: disclosure@vulncheck.com
Exploit Issue Tracking Third Party Advisory
https://github.com/JamesNK/Newtonsoft.Json/pull/2462
Source: disclosure@vulncheck.com
Patch
https://github.com/advisories/GHSA-5crp-9r3c-p9vr
Source: disclosure@vulncheck.com
Third Party Advisory
https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678
Source: disclosure@vulncheck.com
Exploit Third Party Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vr
Source: disclosure@vulncheck.com
Third Party Advisory
https://alephsecurity.com/2018/10/22/StackOverflowException/
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
https://alephsecurity.com/vulns/aleph-2018004
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
https://github.com/JamesNK/Newtonsoft.Json/issues/2457
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Issue Tracking Third Party Advisory
https://github.com/JamesNK/Newtonsoft.Json/pull/2462
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
https://github.com/advisories/GHSA-5crp-9r3c-p9vr
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vr
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

16 reference(s) from NVD

Quick Stats

CVSS v3 Score
7.5 / 10.0
EPSS (Exploit Probability)
3.0%
86th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-755 CWE-755

Affected Vendors

newtonsoft

Related CVEs

CVE-2025-52691 10.0
CVE-2025-15168 7.3
CVE-2025-15167 7.3
CVE-2025-15166 7.3
CVE-2025-15165 7.3