Sereal::Encoder versions from 4.000 through 4.009_002 for Perl is vulnerable to a buffer overwrite flaw in the Zstandard library.

Sereal::Encoder embeds a vers…

Sereal::Encoder versions 4.000 through 4.009_002 for Perl contains a buffer overwrite vulnerability in its embedded Zstandard compression library. The flaw is linked to CVE-2019-11922, a race condition in Zstandard versions prior to 1.3.8 that affects one-pass compression functions. Attackers can exploit this vulnerability to write bytes out of bounds when output buffers smaller than recommended size are used. This represents a supply chain security issue where an older vulnerable dependency creates security risks in newer software versions.