CVE-2024-1651 is a critical (CVSS 10.0) insecure deserialization flaw in TorrentPier 2.4.1 that allows executing arbitrary commands on the server. At public disclosure on 19 February 2024 Fluid Attacks said no patch was available. Check the project's releases for a newer version before relying on that.
What's affected
The record lists TorrentPier 2.4.1. The advisory says the application deserializes arbitrary data sent by the user, which lets an attacker run commands on the server. Its mitigation section says there is currently no patch available. Its timeline says the vendor was contacted on 5 February 2024, replied and confirmed on 7 February 2024, and that the issue became public on 19 February 2024.
The NVD score is 10.0 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The weakness is CWE-502 (deserialization of untrusted data). We did not confirm a fixed release, so check the project's repository for the latest status.
How to check if you're exposed
Find out which version you run. Look at the version shown in the application or in the project's changelog in your deployment directory, and compare it with the repository's tags.
If you run 2.4.1, assume you are affected until you confirm a newer release that addresses the issue. Review web server logs for unusual requests to endpoints that accept serialized data, and check the host for unexpected files or processes.
What to do now
- Check the TorrentPier repository for a release newer than 2.4.1 and read its notes.
- If no fix is available, put the application behind access controls such as a VPN or an allow list.
- Add a web application firewall rule if your platform supports it, and monitor logs.
- Run the application with the least privileges possible, and isolate it from other systems.
- Plan a replacement or a maintained fork if the project does not ship a fix.
Why it matters
Deserialization turns stored or transmitted bytes back into objects. If the bytes come from an attacker and the language allows objects to run code as they are rebuilt, the result is code execution. The cure is to avoid native object deserialization for untrusted data and use a plain data format with validation.
A 10.0 score reflects network reach, no required privileges and full impact. The record's KEV flag is false, and the advisory does not describe exploitation. The lack of a patch is what makes this one urgent for operators. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Quick check
Is there a patch?
Fluid Attacks reported none at disclosure. Check the project repository for newer releases.
Sources
Last reviewed: 19 October 2026.
