CVE-2026-23736
Description
A flaw was found in seroval. Due to improper input validation during JSON deserialization, a remote attacker could provide a malicious object key. This could lead to prototype pollution, potentially allowing the attacker to alter the behavior of the application or disclose sensitive information. This vulnerability specifically affects the JSON deserialization functionality.
Statement
This vulnerability is rated Important for Red Hat as it affects the seroval library, which is utilized in forgejo within Fedora and EPEL. The flaw allows for prototype pollution during JSON deserialization due to improper input validation in versions 1.4.0 and below. Exploitation requires processing of malicious JSON input.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Read Application Data; Modify Application Data
This weakness is usually exploited by using a special attribute of objects called proto, constructor, or prototype. Such attributes give access to the object prototype. An attacker can inject attributes that are used in other components by adding or modifying attributes of an object prototype. This creates attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of the object prototype (such as hasOwnProperty, toString, or valueOf).
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
