AIKIDO-2024-10483

TL;DR

Affected versions of this package use a vulnerable version of the Newtonsoft.Json library, specifically versions prior to 13.0.1. These versions are impacted by CVE-2024-21907, which stems from insecure defaults in handling deeply nested expressions. This can lead to a StackOverflowException or excessive CPU and memory consumption, resulting in a Denial of Service (DoS). Attackers can exploit this vulnerability by providing input with high nesting levels, overwhelming system resources and causing the application to crash or become unresponsive. However, the risk can be mitigated by manually configuring the MaxDepth property in JsonSerializerSettings to limit the depth of nested objects during serialization, which is done for Hangfire.Core in the patch version.