CVE-2024-24786

CVE-2024-24786

High · published March 6, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
69.4
In the wild
Unconfirmed
What it is

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01262 · 69.4th percentile
Published
2024-03-06T04:15Z
References (10)
http://www.openwall.com/lists/oss-security/2024/03/08/4 · [email protected]https://go.dev/cl/569356 · [email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU/ · [email protected]https://pkg.go.dev/vuln/GO-2024-2611 · [email protected]https://security.netapp.com/advisory/ntap-20240517-0002/ · [email protected]http://www.openwall.com/lists/oss-security/2024/03/08/4 · af854a3a-2127-422b-91ae-364da2661108https://go.dev/cl/569356 · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU/ · af854a3a-2127-422b-91ae-364da2661108https://pkg.go.dev/vuln/GO-2024-2611 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240517-0002/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 05 MAR 22:22Z
    Infinite loop in JSON unmarshaling in google.golang.org/protobuf
    cvelistv5