CVE-2024-21907

Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

• CWE-755
• CWE-755

• https://alephsecurity.com/2018/10/22/StackOverflowException/Exploit
• https://alephsecurity.com/vulns/aleph-2018004Exploit
• https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66Patch
• https://github.com/JamesNK/Newtonsoft.Json/issues/2457Exploit, Issue Tracking, Third Party Advisory
• https://github.com/JamesNK/Newtonsoft.Json/pull/2462Patch
• https://github.com/advisories/GHSA-5crp-9r3c-p9vrThird Party Advisory
• https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678Exploit, Third Party Advisory
• https://vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vrThird Party Advisory
• https://alephsecurity.com/2018/10/22/StackOverflowException/Exploit
• https://alephsecurity.com/vulns/aleph-2018004Exploit
• https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66Patch
• https://github.com/JamesNK/Newtonsoft.Json/issues/2457Exploit, Issue Tracking, Third Party Advisory
• https://github.com/JamesNK/Newtonsoft.Json/pull/2462Patch
• https://github.com/advisories/GHSA-5crp-9r3c-p9vrThird Party Advisory
• https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678Exploit, Third Party Advisory
• https://vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vrThird Party Advisory

Published

Jan 3, 2024

Last Modified

Jul 14, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21901A SQL injection vulnerability has been reported to affect my…4.7
• CVE-2024-21902An incorrect permission assignment for critical resource vul…8.1
• CVE-2024-21903An OS command injection vulnerability has been reported to a…4.7
• CVE-2024-21904A path traversal vulnerability has been reported to affect s…6.5
• CVE-2024-21905An integer overflow or wraparound vulnerability has been rep…8.2
• CVE-2024-21906An OS command injection vulnerability has been reported to a…4.7
• CVE-2024-21908TinyMCE versions before 5.9.0 are affected by a stored cross…6.1
• CVE-2024-21909PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a…7.5
• CVE-2024-2191An issue was discovered in GitLab CE/EE affecting all versio…5.3
• CVE-2024-21910TinyMCE versions before 5.10.0 are affected by a cross-site …6.1
• CVE-2024-21911TinyMCE versions before 5.6.0 are affected by a stored cross…6.1
• CVE-2024-21912 An arbitrary code execution vulnerability in Rockwell Autom…7.8