Improper Handling of Exceptional Conditions in Newtonsoft.Json
Priority HIGH 72CWE-755Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.32908 98th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed Newtonsoft.Json: 13.0.1Newtonsoft.Json (NuGet): 13.0.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Newtonsoft.Json | before 13.0.1 | 13.0.1 | Patch available | CNA |
| — | Newtonsoft.Json (NuGet) | before 13.0.1 | 13.0.1 | Patch available | GHSA-5crp-9r3c-p9vr |
- Newtonsoft.Json Vendor— Affected before 13.0.1 Fixed in 13.0.1 Patch available CNA
- Newtonsoft.Json (NuGet) Vendor— Affected before 13.0.1 Fixed in 13.0.1 Patch available GHSA-5crp-9r3c-p9vr
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:newtonsoft:json.net:*:*:*:*:*:*:*:* | before 13.0.1 | Vulnerable | Newtonsoft |
- cpe:2.3:a:newtonsoft:json.net:*:*:*:*:*:*:*:* Versions before 13.0.1 Vulnerable ·Newtonsoft
Remediation
- Fix · CNA Newtonsoft.Json Fixed in 13.0.1
- Fix · GHSA-5crp-9r3c-p9vr Newtonsoft.Json (NuGet) Fixed in 13.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-21907
- 2026-10-03 Alias added: GHSA-5crp-9r3c-p9vr
References
Exploit 3
Patch 2
Sources
- CVE-2024-21907 · CVE Program
- CVE-2024-21907 · NVD
- FIRST EPSS
- GHSA-5crp-9r3c-p9vr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences