Seroval CVE-2026-116581

Exploitable only when the application passes attacker-controlled input to seroval's fromJSON or fromCrossJSON deserialization functions; the sequence/iterator variant additionally requires the application to consume the reconstructed iterator to completion, at which point a sequence node whose 'done' (or 'throw') index falls outside the element list produces an iterator that never terminates (CWE-835), while the related array variant lets a node-supplied length block the decoding thread directly. Limiting factor: merely importing or using the library on trusted data is not vulnerable - only services deserializing untrusted seroval payloads are affected. Once such an endpoint is reached, no authentication and no user interaction are required (PR:N/UI:N per the provided CVSS vector). The only complete fix per the vendor is upgrading to 1.6.8; the advisory explicitly states there is no workaround.

Signals are broadly consistent and point to a genuine but non-emergency availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 High) describes an unauthenticated, low-complexity, network-reachable denial of service with availability-only impact - no confidentiality or integrity loss, which caps the ceiling. EPSS is low at 0.45% (39th percentile), the CVE is NOT listed in CISA KEV, and there is no public exploit identified at time of analysis, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_week', which aligns with a real-but-not-critical DoS. The key tempering factor the raw CVSS does not capture is reachability: PR:N/AC:L is only meaningful once an application actually passes untrusted input to seroval's fromJSON/fromCrossJSON, and the iterator variant additionally requires the app to consume the resulting iterator to completion - so exposure depends on application design rather than mere presence of the library. Net: a legitimate patch-this-week item for services that deserialize untrusted seroval payloads, not a drop-everything emergency; the low EPSS and absence of KEV/exploit support that prioritization.

An attacker sends a crafted seroval JSON payload to an unauthenticated endpoint of a service that deserializes untrusted input with fromJSON or fromCrossJSON. The malformed sequence node carries an out-of-range 'done' index, so when application code iterates the reconstructed value to completion the iterator never terminates, pinning the event loop or exhausting memory; the related array-length variant blocks the thread directly during decode. No public standalone exploit is identified, though the vendor's patch ships a regression test demonstrating the malformed-index trigger.