CVE-2026-23957
Denial of Service via Array Length Manipulation in seroval
Publication date: 2026-01-22
Last updated on: 2026-04-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lxsmnsyc | seroval | to 1.4.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in seroval versions 1.4.0 and below allows an attacker to override encoded array lengths during deserialization with an excessively large value. This causes the deserialization process to take significantly more processing time, leading to a denial of service (DoS) condition. The issue arises because the deserialization trusts the encoded array length, which can be manipulated to consume excessive resources. [2]
How can this vulnerability impact me? :
The vulnerability can cause a denial of service by making the deserialization process consume excessive CPU time, potentially making the application unresponsive or unavailable. It can be exploited remotely over the network without any privileges or user interaction, impacting the availability of services using seroval versions 1.4.0 and below. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unusually high CPU usage or processing time during deserialization of data using the seroval library versions 1.4.0 and below. Since the issue involves overriding encoded array lengths with excessively large values, detection could involve inspecting network traffic or logs for payloads containing abnormally large array length fields targeting seroval deserialization. Specific commands are not provided in the resources. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the seroval package to version 1.4.1 or later, where the vulnerability is fixed by removing the encoding of array lengths and computing array length dynamically during deserialization. This prevents attackers from injecting artificially large array lengths and avoids the denial of service condition. [2, 1]