Go/google.golang.org/protobuf CVE-2023-24535: unknown, EPSS 1.09%

Panic when parsing invalid messages in google.golang.org/protobuf

Action: Upgrade google.golang.org/protobuf to 1.29.1 or later.

go get google.golang.org/protobuf@v1.29.1

Affected

Fixed versions

Sources

• osv: GO-2023-1631
• https://go.dev/cl/475995
• https://github.com/golang/protobuf/issues/1530

CVE-2023-24535 · published 2023-03-14T16:47:00Z · modified 2026-02-04T04:28:08.549542Z · JSON