CVE-2026-116584: Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

October 28, 2026

fromJSON and fromCrossJSON did not check that an array node’s element list is an array. A small crafted payload could set the length the decoder used. That length controlled how much memory was allocated and how many times the decoder looped, and it did not depend on the size of the payload.

References

github.com/advisories/GHSA-wp97-x4hv-qvhp
github.com/lxsmnsyc/seroval/commit/cdcee3e3bc384ee844360844f8ea98fd2b275d69
github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8
github.com/lxsmnsyc/seroval/security/advisories/GHSA-wp97-x4hv-qvhp
nvd.nist.gov/vuln/detail/CVE-2026-116584

Code Behaviors & Features

Detect and mitigate CVE-2026-116584 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →