CVE-2024-21907

High

Description

Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

SeverityHigh

CVSS7.5

Exploit probability—

ProductNewtonsoft.json

PublishedJan 3, 2024

First seenJan 3, 2024

Weakness typeCWE-755CWE-755

How to fix

Update

Newtonsoft.Json13.0.1 or later
newtonsoft json.net13.0.1 or later

Patches

github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66

Vendor advisories

github.com/advisories/GHSA-5crp-9r3c-p9vr

Affected products

Product	Affected versions	Fixed in
Newtonsoft.JsonNuGet	v < 13.0.1	13.0.1
newtonsoft json.net	v < 13.0.1	13.0.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.