Threats affecting pkg:github/Sereal-Decoder

CVE-2026-8796 is a heap out-of-bounds read vulnerability in Sereal::Decoder for Perl versions before 5.005. It occurs when processing a crafted COPY tag that causes the decoder to read beyond the input buffer, potentially leaking up to 31 bytes from the heap. The vulnerability arises from improper bounds checking when decoding certain back-references interpreted as SHORT_BINARY tags. This flaw can lead to information disclosure and denial of service. No official patch or remediation guidance has been provided yet.

Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.