Vulnerability GHSA-hw7c-3rfg-p46j
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
3 years ago
March 14, 2023 at 11:01 PM UTC
google.golang.org/protobuf vulnerable to panic leading to denial of service
v1.29.0
v1.29.0
Summary
google.golang.org/protobuf vulnerable to panic leading to denial of service
Details
Parsing invalid messages can panic.
Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
2 years ago
Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON
v1.20.0 - v1.32.0 GHSA-8r3f-844c-mc37
v1.20.0 - v1.32.0 GHSA-8r3f-844c-mc37
Unknown
2 years ago
Infinite loop in JSON unmarshaling in google.golang.org/protobuf
v1.20.0 - v1.32.0 GO-2024-2611
v1.20.0 - v1.32.0 GO-2024-2611
Unknown
3 years ago
Panic when parsing invalid messages in google.golang.org/protobuf
v1.29.0 GO-2023-1631
v1.29.0 GO-2023-1631
Impacted packages
Timeline
Published
3 years ago
March 14, 2023 at 11:01 PM UTC
Last Modified
1 month ago
September 10, 2026 at 03:49 AM UTC