{"action":"Upgrade google-protobuf to 3.25.5 (3.25.x), 4.27.5 (4.27.x) or 4.28.2 (4.28.x) or later.","affected":[{"fixed":"3.25.5","introduced":"0"},{"fixed":"4.27.5","introduced":"4.0.0.rc.1"},{"fixed":"4.28.2","introduced":"4.28.0.rc.1"}],"component":"google-protobuf","cve_ids":["CVE-2024-7254"],"ecosystem":"RubyGems","epss":0.02772,"exploited":false,"fixed_versions":["3.25.5","4.27.5","4.28.2"],"ghsa_id":"GHSA-735f-pc8j-v9w8","id":"tcs_01M5KEHG1QKD4235SPMKHS2XBY","modified_at":"2026-09-10T03:50:19.212518465Z","published_at":"2024-09-19T16:06:03Z","references":["https://osv.dev/vulnerability/GHSA-735f-pc8j-v9w8","https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8","https://nvd.nist.gov/vuln/detail/CVE-2024-7254","https://github.com/protocolbuffers/protobuf/commit/4728531c162f2f9e8c2ca1add713cfee2db6be3b","https://github.com/protocolbuffers/protobuf/commit/850fcce9176e2c9070614dab53537760498c926b","https://github.com/protocolbuffers/protobuf/commit/9a5f5fe752a20cbac2e722b06949ac985abdd534","https://github.com/protocolbuffers/protobuf/commit/ac9fb5b4c71b0dd80985b27684e265d1f03abf46","https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa","https://github.com/protocolbuffers/protobuf/commit/d6c82fc55a76481c676f541a255571e8950bb8c3","https://github.com/protocolbuffers/protobuf","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/google-protobuf/CVE-2024-7254.yml","https://security.netapp.com/advisory/ntap-20241213-0010","https://security.netapp.com/advisory/ntap-20250418-0006"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-735f-pc8j-v9w8","url":"https://osv.dev/vulnerability/GHSA-735f-pc8j-v9w8"}],"summary":"protobuf-java has potential Denial of Service issue"}