# CVE-2024-21907: Improper Handling of Exceptional Conditions in Newtonsoft.Json

> CVE-2024-21907 (GitHub advisory GHSA-5crp-9r3c-p9vr) is a high-severity vulnerability with a CVSS 3.1 base score of 7.5, classed as Improper Handling of Exceptional Conditions (CWE-755), in Newtonsoft.Json (NuGet). Affected versions: < 13.0.1. It is fixed in 13.0.1.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2024-21907

| Field | Value |
| --- | --- |
| CVE | CVE-2024-21907 |
| GHSA | GHSA-5crp-9r3c-p9vr |
| Severity | High |
| CVSS 3.1 | 7.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` (GitHub Advisory Database) |
| CWE | CWE-755 Improper Handling of Exceptional Conditions |
| EPSS | 32.9% (higher than 98% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation poc, automatable yes, technical impact partial |
| Published | 22 Jun 2022 |
| Modified | 14 Jul 2026 |

## Description

Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of expressions with high nesting level that lead to StackOverFlow exception or high CPU and RAM usage. Exploiting this vulnerability results in Denial Of Service (DoS). 

The serialization and deserialization path have different properties regarding the issue.

Deserializing methods (like `JsonConvert.DeserializeObject`) will process the input that results in burning the CPU, allocating memory, and consuming a thread of execution. Quite high nesting level (>10kk, or 9.5MB of `{a:{a:{...` input) is needed to achieve the latency over 10 seconds, depending on the hardware.

Serializing methods (like `JsonConvert.Serialize` or `JObject.ToString`) will throw StackOverFlow exception with the nesting level of around 20k.

To mitigate the issue one either need to update Newtonsoft.Json to 13.0.1 or set `MaxDepth` parameter in the `JsonSerializerSettings`. This can be done globally with the following statement. After that the parsing of the nested input will fail fast with `Newtonsoft.Json.JsonReaderException`:

``` 
JsonConvert.DefaultSettings = () => new JsonSerializerSettings { MaxDepth = 128 };
```

Repro code:
```
//Create a string representation of an highly nested object (JSON serialized)
int nRep = 25000;
string json = string.Concat(Enumerable.Repeat("{a:", nRep)) + "1" +
 string.Concat(Enumerable.Repeat("}", nRep));

//Parse this object (leads to high CPU/RAM consumption)
var parsedJson = JsonConvert.DeserializeObject(json);

// Methods below all throw stack overflow with nRep around 20k and higher
// string a = parsedJson.ToString();
// string b = JsonConvert.SerializeObject(parsedJson);
```

##### Additional affected product and version information
**The original statement about the problem only affecting IIS applications is misleading.** Any application is affected, however the IIS has a behavior that stops restarting the instance after some time resulting in a harder-to-fix DoS.**

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| Newtonsoft.Json | NuGet | `pkg:nuget/Newtonsoft.Json` | < 13.0.1 | 13.0.1 |

## Fix commits

- Patch: https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66
- Pull request: https://github.com/JamesNK/Newtonsoft.Json/pull/2462
- Release: https://github.com/jamesnk/newtonsoft.json/commit/ae9fe44e1323e91bcbd185ca1a14099fba7c021f (13.0.1)

## Questions

**What is the GHSA ID for CVE-2024-21907?**

GitHub tracks CVE-2024-21907 as GHSA-5crp-9r3c-p9vr.

**What is the CVSS score of CVE-2024-21907?**

CVE-2024-21907 has a CVSS 3.1 base score of 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

**Which versions are affected by CVE-2024-21907?**

Newtonsoft.Json (NuGet): < 13.0.1.

**How do I fix CVE-2024-21907?**

Upgrade to 13.0.1 or later. The fix is in commit 7e77bbe and pull request #2462.

**What is the Package URL (PURL) for CVE-2024-21907?**

The affected package's PURL is pkg:nuget/Newtonsoft.Json.

**Is CVE-2024-21907 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2024-21907. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "poc". EPSS estimates a 32.9% chance of exploitation in the next 30 days, higher than 98% of CVEs.

## References

- https://github.com/JamesNK/Newtonsoft.Json/pull/2462 (fix)
- https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66 (fix)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21907.json (advisory)
- https://github.com/advisories/GHSA-5crp-9r3c-p9vr (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2024-21907 (advisory)
- https://vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vr (advisory)
- https://github.com/JamesNK/Newtonsoft.Json/issues/2457 (report)
- https://github.com/JamesNK/Newtonsoft.Json (package)
- https://alephsecurity.com/2018/10/22/StackOverflowException
- https://alephsecurity.com/vulns/aleph-2018004
- https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678
- https://nuget.org/packages

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2024-21907), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.