Sereal::Encoder versions 4.000 through 4.009_002 include an embedded Zstandard (zstd) library version vulnerable to CVE-2019-11922. This underlying Zstandard vulnerability is a race condition in the one-pass compression functions prior to version 1.3.8, which may allow an attacker to write bytes out of bounds when an output buffer smaller than recommended is used. The vulnerability is categorized under CWE-1395 (Dependency on Vulnerable Third-Party Component). The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

The vulnerability allows potential out-of-bounds memory writes during compression operations, which can compromise confidentiality, integrity, and availability of affected systems using the vulnerable Sereal::Encoder versions. This could lead to arbitrary code execution or application crashes depending on exploitation, though no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor for updates from the YVES project or Sereal::Encoder maintainers. Consider avoiding use of affected versions or replacing the embedded Zstandard library with a fixed version (1.3.8 or later) if feasible.