Go/google.golang.org/protobuf CVE-2024-24786: high 7.5, EPSS 1.26%
Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON
Action: Upgrade google.golang.org/protobuf to 1.33.0 or later.
go get google.golang.org/protobuf@v1.33.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.33.0 | - |
Fixed versions
| 1.33.0 |
Sources
- osv: GHSA-8r3f-844c-mc37
- https://nvd.nist.gov/vuln/detail/CVE-2024-24786
- https://github.com/protocolbuffers/protobuf-go/commit/f01a588e5810b90996452eec4a28f22a0afae023
- https://github.com/protocolbuffers/protobuf-go
- https://github.com/protocolbuffers/protobuf-go/releases/tag/v1.33.0
- https://go.dev/cl/569356
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU
- https://pkg.go.dev/vuln/GO-2024-2611
- https://security.netapp.com/advisory/ntap-20240517-0002
- http://www.openwall.com/lists/oss-security/2024/03/08/4
CVE-2024-24786 · published · modified · JSON