CVE-2024-7254

Description

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

Reserved 2024-07-29 | Published 2024-09-19 | Updated 2024-12-13 | Assigner Google

Problem types

CWE-20 Improper Input Validation

Product status

Default status
unaffected

Any version before 28.2
affected

Default status
unaffected

Any version before 3.25.5
affected

Any version before 4.27.5
affected

Any version before 4.28.2
affected

Default status
unaffected

Any version before 3.25.5
affected

Any version before 4.27.5
affected

Any version before 4.28.2
affected

Default status
unaffected

Any version before 3.25.5
affected

Any version before 4.27.5
affected

Any version before 4.28.2
affected

Default status
unaffected

Any version before 3.25.5
affected

Any version before 4.27.5
affected

Any version before 4.28.2
affected

Default status
unaffected

Any version before 3.25.5
affected

Any version before 4.27.5
affected

Any version before 4.28.2
affected

Credits

Alexis Challande, Trail of Bits Ecosystem Security Team <ecosystem@trailofbits.com> finder

References

github.com/...ommit/cc8b3483a5584b3301e3d43d17eb59704857ffaa

cve.org (CVE-2024-7254)

nvd.nist.gov (CVE-2024-7254)

Download JSON