Sereal::Decoder versions 4.000 through 4.009_002 embed a vulnerable version of the Zstandard compression library that is affected by CVE-2019-11922. This underlying vulnerability is a race condition in the one-pass compression functions of zstd prior to version 1.3.8, which can lead to out-of-bounds writes when the output buffer is smaller than recommended. This dependency on a vulnerable third-party component (CWE-1395) exposes Sereal::Decoder to potential memory corruption issues. The vulnerability has a CVSS v3.1 base score of 8.1, reflecting a high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction.

Successful exploitation of this vulnerability could allow an attacker to cause out-of-bounds memory writes, potentially leading to arbitrary code execution, data corruption, or denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Avoid using affected versions if possible or apply mitigations recommended by the vendor once available.