CVE-2024-7254

CVSS V2 None CVSS V3 None

Description

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

Overview

CVE ID
CVE-2024-7254

Assigner
Google

Vulnerability Status
PUBLISHED

Published Version
2024-09-19T00:18:45.824Z

Last Modified Date
2024-09-19T00:18:45.824Z

Weakness Enumerations

CWE	URL
CWE-20	http://cwe.mitre.org/data/definitions/20.html

References

Reference URL	Reference Tags
https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-7254
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254

History

Created	Old Value	New Value	Data Type	Notes
2024-10-06 04:12:08				Added to TrackCVE