CVE-2024-21907: CWE-755 Improper Handling of Exceptional Conditions
Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.
AI Analysis
Technical Summary
CVE-2024-21907 is a vulnerability in Newtonsoft.Json prior to version 13.0.1 involving improper handling of exceptional conditions (CWE-755). Specifically, when the JsonConvert.DeserializeObject method processes crafted input data, it may cause a StackOverflow exception. This exception leads to a denial of service condition. The vulnerability is exploitable remotely without authentication, contingent on the usage context of the library. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.
Potential Impact
An attacker can remotely cause a denial of service by triggering a StackOverflow exception in the JsonConvert.DeserializeObject method. This results in application or service disruption. There is no impact on confidentiality or integrity according to the CVSS vector. The vulnerability does not require authentication or user interaction.
Mitigation Recommendations
A fix is available in Newtonsoft.Json version 13.0.1. Users should upgrade to version 13.0.1 or later to remediate this vulnerability. No other mitigation or temporary workaround is indicated in the provided data.
CVE-2024-21907: CWE-755 Improper Handling of Exceptional Conditions
Description
Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-21907 is a vulnerability in Newtonsoft.Json prior to version 13.0.1 involving improper handling of exceptional conditions (CWE-755). Specifically, when the JsonConvert.DeserializeObject method processes crafted input data, it may cause a StackOverflow exception. This exception leads to a denial of service condition. The vulnerability is exploitable remotely without authentication, contingent on the usage context of the library. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.
Potential Impact
An attacker can remotely cause a denial of service by triggering a StackOverflow exception in the JsonConvert.DeserializeObject method. This results in application or service disruption. There is no impact on confidentiality or integrity according to the CVSS vector. The vulnerability does not require authentication or user interaction.
Mitigation Recommendations
A fix is available in Newtonsoft.Json version 13.0.1. Users should upgrade to version 13.0.1 or later to remediate this vulnerability. No other mitigation or temporary workaround is indicated in the provided data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2024-01-03T14:21:17.582Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 692a23934c03a75d3feb274d
Added to database: 11/28/2025, 22:34:59 UTC
Last enriched: 07/15/2026, 09:44:57 UTC
Last updated: 09/10/2026, 19:36:47 UTC
Views: 648
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.