HIGH✓ PATCH🇬🇧 English

CVE-2024-7254

CVSS 8.7v4.0pub. 2024-09-19upd. 2025-09-26

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

oryginał EN

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Google Protobuf
APP
Google
< 3.25.54.0.0 – 4.27.5 (bez)4.28.0 – 4.28.2 (bez)
Google Protobuf Java
APP
Google
< 3.25.54.0.0 – 4.27.5 (bez)4.28.0 – 4.28.2 (bez)
Google Protobuf Javalite
APP
Google
< 3.25.54.0.0 – 4.27.5 (bez)4.28.0 – 4.28.2 (bez)
Google Protobuf Kotlin
APP
Google
< 3.25.54.0.0 – 4.27.5 (bez)4.28.0 – 4.28.2 (bez)
Google Protobuf Kotlin Lite
APP
Google
< 3.25.54.0.0 – 4.27.5 (bez)4.28.0 – 4.28.2
Netapp Active Iq Unified Manager
APP
Netapp
wszystkie wersje
Netapp Bluexp
APP
Netapp
wszystkie wersje
Netapp Ontap Tools
APP
Netapp
10