High severity · published Sep 19, 2024
CVE-2024-7254
Stack overflow in Protocol Buffers Java Lite
7.5
CVSS
2.8%
EPSS
No
On KEV
Description
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PB
Protocol Buffers · Google
before 28.2 · source: vendor
GJ
google-protobuf [JRuby Gem] · Google
before 3.25.5; before 4.27.5; before 4.28.2 · source: vendor
PR
protobuf-java · Google
before 3.25.5; before 4.27.5; before 4.28.2 · source: vendor, NVD
PR
protobuf-javalite · Google
before 3.25.5; before 4.27.5; before 4.28.2 · source: vendor, NVD
PR
protobuf-kotlin · Google
before 3.25.5; before 4.27.5; before 4.28.2 · source: vendor, NVD
PR
protobuf-kotllin-lite · Google
before 3.25.5; before 4.27.5; before 4.28.2 · source: vendor
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
BL
Bluexp · Netapp
All versions, or not specified · source: NVD
OT
Ontap Tools · Netapp
10 · source: NVD
PR
Protobuf · Google
before 3.25.5; 4.0.0 before 4.27.5; 4.28.0 before 4.28.2 · source: NVD, CISA
PR
Protobuf-kotlin-lite · Google
before 3.25.5; 4.0.0 before 4.27.5; 4.28.0 through 4.28.2 · source: NVD, CISA