An unauthenticated attacker can trigger a denial of service condition in the Seroval library by submitting maliciously crafted objects that exceed the maximum call stack limit during serialization.

This vulnerability is classified as CWE-770, which involves the allocation of resources without limits or throttling. By processing objects with extreme depth, the library consumes excessive stack resources, leading to a crash, and this can be triggered by an unauthenticated attacker.

The exploitation of this flaw leads to a denial of service, which can render applications utilizing the Seroval library unresponsive or cause them to crash. With a CVSS score of 7.5, this high-severity vulnerability poses a significant risk to application availability and stability, potentially disrupting critical business operations if the affected services are public-facing.

Immediate Action: Update the Seroval package to version 1.4.1 or later, which introduces a configurable depthLimit parameter to prevent stack exhaustion.

Proactive Monitoring: Monitor application error logs for frequent stack overflow exceptions or unexpected service restarts that may indicate attempted exploitation.

Compensating Controls: Implement input validation to restrict the complexity and nesting depth of JSON or object payloads accepted by the application to prevent deep structures from reaching the serialization layer.

Public Exploit Available: No (exploit_available: unknown)

Given the high severity of this denial of service vulnerability and the relative ease of exploitation, all organizations using the Seroval library should prioritize the update to version 1.4.1. Applying this patch is the only effective way to implement the necessary depth limits and ensure the continued stability and availability of your applications.