Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions
    vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a
    StackOverflow exception resulting in denial of service. Depending on the usage of the library, an
    unauthenticated and remote attacker may be able to cause the denial of service condition. (CVE-2024-21907)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions     vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a     StackOverflow exception resulting in denial of service. Depending on the usage of the library, an     unauthenticated and remote attacker may be able to cause the denial of service condition. (CVE-2024-21907)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Microsoft SQL Server installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerabilities:

  - Improper Handling of Exceptional Conditions in Newtonsoft.Json (CVE-2024-21907)

  - An information disclosure vulnerability (CVE-2025-47997)

  - A privilege escalation vulnerability (CVE-2025-55227)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
455462	Echo: Newtonsoft.Json: security update to 10.0.1+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
455462	Echo: Newtonsoft.Json: security update to 10.0.1+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
262030	Linux Distros Unpatched Vulnerability : CVE-2024-21907	Nessus	Misc.	Local	high
261809	Security Updates for Microsoft SQL Server (September 2025)	Nessus	Windows : Microsoft Bulletins	Local	high
410773	SCA: security update for Newtonsoft.Json (GHSA-5crp-9r3c-p9vr)	Tenable Cloud Security	SCA Checks	Local	high
410773	SCA: security update for Newtonsoft.Json (GHSA-5crp-9r3c-p9vr)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2024-21907

high

Tenable Plugins

high

high

high

high

high

high