Vulnerability GHSA-8r3f-844c-mc37
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
2 years ago
March 06, 2024 at 12:31 AM UTC
Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON
v1.20.0 - v1.32.0
v1.20.0 - v1.32.0
Summary
Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON
Details
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
2 years ago
Infinite loop in JSON unmarshaling in google.golang.org/protobuf
v1.20.0 - v1.32.0 GO-2024-2611
v1.20.0 - v1.32.0 GO-2024-2611
High Risk
3 years ago
google.golang.org/protobuf vulnerable to panic leading to denial of service
v1.29.0 GHSA-hw7c-3rfg-p46j
v1.29.0 GHSA-hw7c-3rfg-p46j
Unknown
3 years ago
Panic when parsing invalid messages in google.golang.org/protobuf
v1.29.0 GO-2023-1631
v1.29.0 GO-2023-1631
Impacted packages
Timeline
Published
2 years ago
March 06, 2024 at 12:31 AM UTC
Last Modified
1 month ago
September 10, 2026 at 03:50 AM UTC