Vulnerability GO-2024-2611
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 years ago
March 05, 2024 at 08:24 PM UTC
Infinite loop in JSON unmarshaling in google.golang.org/protobuf
v1.20.0 - v1.32.0
v1.20.0 - v1.32.0
Summary
Infinite loop in JSON unmarshaling in google.golang.org/protobuf
Details
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
2 years ago
Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON
v1.20.0 - v1.32.0 GHSA-8r3f-844c-mc37
v1.20.0 - v1.32.0 GHSA-8r3f-844c-mc37
High Risk
3 years ago
google.golang.org/protobuf vulnerable to panic leading to denial of service
v1.29.0 GHSA-hw7c-3rfg-p46j
v1.29.0 GHSA-hw7c-3rfg-p46j
Unknown
3 years ago
Panic when parsing invalid messages in google.golang.org/protobuf
v1.29.0 GO-2023-1631
v1.29.0 GO-2023-1631
Impacted packages
Timeline
Published
2 years ago
March 05, 2024 at 08:24 PM UTC
Last Modified
4 hours ago
October 14, 2026 at 10:56 AM UTC