Security readout for executives and security teams
Plain-English summary
Newtonsoft.Json versions before 13.0.1 can crash while deserializing maliciously shaped JSON. If an internet-facing service accepts untrusted JSON and uses this library path, an unauthenticated remote attacker may be able to cause denial of service.
Executive priority
Treat as a high-priority availability risk for public .NET services. It does not indicate data theft or code execution, but a simple unauthenticated request path may be enough to interrupt service if vulnerable parsing is exposed.
Technical view
The flaw is improper handling of exceptional conditions in JsonConvert.DeserializeObject, producing a StackOverflow exception. CVSS 3.1 is 7.5, network exploitable, low complexity, no privileges or user interaction, with availability impact only. Sources identify a patch before/at 13.0.1.
Likely exposure
Most likely exposure is .NET applications using Newtonsoft.Json before 13.0.1 to deserialize untrusted client-supplied JSON, especially public APIs. The CVE bundle’s affected-version metadata appears incomplete, so confirm against package manifests and advisories.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. Public issue, pull request, commit, GHSA, Snyk, and VulnCheck references document the vulnerability and fix context, but do not prove exploitation in the wild.
Researcher notes
Focus analysis on call paths where attacker-controlled JSON reaches JsonConvert.DeserializeObject. The vulnerability is denial-of-service via stack overflow, so validation should avoid weaponized payloads and instead rely on dependency inventory, code reachability, and controlled regression testing.
Mitigation direction
- Upgrade Newtonsoft.Json to 13.0.1 or later where used.
- Prioritize internet-facing services that deserialize untrusted JSON.
- Check vendor and package advisory guidance before accepting residual risk.
- Add request size, depth, and timeout controls where supported.
- Redeploy and verify all runtime artifacts use the updated package.
Validation and detection
- Inventory NuGet manifests and lockfiles for Newtonsoft.Json below 13.0.1.
- Find JsonConvert.DeserializeObject usage reachable from untrusted requests.
- Review logs for StackOverflowException, process crashes, or restart loops.
- Confirm deployed binaries reference the remediated Newtonsoft.Json version.
- Run regression tests around JSON parsing and error handling.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-755: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-21907 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/JamesNK/Newtonsoft.Json/issues/2457CVE reference, VulnCheck · issue-tracking
- https://github.com/JamesNK/Newtonsoft.Json/pull/2462CVE reference, VulnCheck · issue-tracking
- https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66CVE reference, VulnCheck · patch
- https://alephsecurity.com/2018/10/22/StackOverflowException/CVE reference, VulnCheck · related
- https://alephsecurity.com/vulns/aleph-2018004CVE reference, VulnCheck · related
- https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678CVE reference, VulnCheck · related
- https://github.com/advisories/GHSA-5crp-9r3c-p9vrCVE reference, VulnCheck · vendor-advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vrCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Handling of Exceptional Conditions
Improper Handling of Exceptional Conditions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.