GHSA-8r3f-844c-mc37 CVE-2024-24786 GO-2024-2611
Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 1.26%
- Chance of exploitation in the next 30 days. Higher than 69.65% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- Fix
- Available
- 3 packages have a fixed version
Description
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| google.golang.org/protobuf | < 1.33.0 |
1.33.0 |
| google.golang.org/protobuf/encoding/protojson | < 1.33.0 |
1.33.0 |
| google.golang.org/protobuf/internal/encoding/json | < 1.33.0 |
1.33.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
google.golang.org/protobuf Go → 1.33.0
- go
go get google.golang.org/protobuf@v1.33.0 && go mod tidy
google.golang.org/protobuf/encoding/protojson Go → 1.33.0
- go
go get google.golang.org/protobuf/encoding/protojson@v1.33.0 && go mod tidy
google.golang.org/protobuf/internal/encoding/json Go → 1.33.0
- go
go get google.golang.org/protobuf/internal/encoding/json@v1.33.0 && go mod tidy
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Unreported
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References
Advisories
Packages
Other links
- github.com/protocolbuffers/protobuf-go/commit/f01a588e5810b90996452eec4a28f22a0…
- github.com/protocolbuffers/protobuf-go/releases/tag/v1.33.0
- go.dev/cl/569356
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBH…
- pkg.go.dev/vuln/GO-2024-2611
- security.netapp.com/advisory/ntap-20240517-0002
- openwall.com/lists/oss-security/2024/03/08/4
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBH…
- security.netapp.com/advisory/ntap-20240517-0002
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hw7c-3rfg-p46j google.golang.org/protobuf vulnerable to panic leading to denial of service | High | Also affects google.golang.org/protobuf |
| GHSA-5849-834g-hvw5 pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search | High | Same weakness, CWE-835 |
| GHSA-mfr5-77xh-9j7h pypdf has possible infinite loop when cloning dictionaries | High | Same weakness, CWE-835 |
| GHSA-h6cr-wjv9-3cpp Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) | Low | Same weakness, CWE-835 |
| GHSA-fw5c-8223-6h42 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) | Medium | Same weakness, CWE-835 |
| EEF-CVE-2026-115269 HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit | Not rated yet | Same weakness, CWE-835 |
| GHSA-3j72-p6qg-6xp7 Pillow: TarIO negative size field causes infinite CPU-spin loop | Medium | Same weakness, CWE-835 |
| GHSA-39mj-jf6j-2qj3 pypdf: Possible infinite loop when hitting EOF in standard xref table | Medium | Same weakness, CWE-835 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor