p PatchFirst

CVE-2024-24786

CVE-2024-24786 · Infinite loop in JSON unmarshaling in google.golang.org/protobuf

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

CVSS 7.5 · High · EPSS 1.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • google.golang.org/protobuf/encoding/protojson

    Versions
    • ≥ 0, < 1.33.0: Affected (semver)

    Update to 1.33.0

  • google.golang.org/protobuf/internal/encoding/json

    Versions
    • ≥ 0, < 1.33.0: Affected (semver)

    Update to 1.33.0

  • golang-google-protobuf Debian:12

    Versions
    • 1.28.1-3
    • 1.31.0-1
    • 1.31.0-1~exp1
    • 1.31.0-1~exp2
    • 1.31.0-1~exp3
    • 1.32.0-1
    • 1.33.0-1
    • 1.36.10-1
    • 1.36.10-2
    • 1.36.5-1
    • 1.36.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-protobuf Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.33.0-1

    Update to 1.33.0-1

  • golang-google-protobuf Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.33.0-1

    Update to 1.33.0-1

  • google-osconfig-agent Ubuntu:Pro:16.04:LTS

    Versions
    • 20210219.00-0ubuntu1~16.04.0
    • 20230504.00-0ubuntu1~16.04.0
    • 20240320.00-0ubuntu1~16.04.0
    • 20240524.03-0ubuntu2~16.04.0
    • 20251028.00-0ubuntu2~16.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-osconfig-agent Ubuntu:Pro:18.04:LTS

    Versions
    • 20210219.00-0ubuntu1~18.04.0
    • 20210608.1-0ubuntu1~18.04.1
    • 20210608.1-0ubuntu1~18.04.2
    • 20220824.00-0ubuntu1~18.04.1
    • 20230504.00-0ubuntu1~18.04.0
    • 20240320.00-0ubuntu1~18.04.0
    • 20240524.03-0ubuntu2~18.04.0
    • 20240926.03-0ubuntu1~18.04.0
    • 20251028.00-0ubuntu2~18.04.0
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-osconfig-agent Ubuntu:Pro:20.04:LTS

    Versions
    • 20210219.00-0ubuntu1~20.04.0
    • 20210608.1-0ubuntu1~20.04.0
    • 20210608.1-0ubuntu1~20.04.1
    • 20220824.00-0ubuntu1~20.04.1
    • 20230504.00-0ubuntu1~20.04.0
    • 20240320.00-0ubuntu1~20.04.0
    • 20240320.00-0ubuntu1~20.04.1
    • 20240524.03-0ubuntu2~20.04.0
    • 20240926.03-0ubuntu1~20.04.0
    • 20250115.01-0ubuntu1~20.04.0
    • 20251028.00-0ubuntu2~20.04.0
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-protobuf Ubuntu:22.04:LTS

    Versions
    • 1.25.0+git20201208.160c747-1
    • 1.27.1-1
    • 1.27.1-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:22.04:LTS

    Versions
    • 20210629.00-0ubuntu1
    • 20210629.00-0ubuntu2
    • 20220104.00-0ubuntu1
    • 20220104.00-0ubuntu2
    • 20220622.00-0ubuntu2~22.04.0
    • 20220622.00-0ubuntu2~22.04.1
    • 20230426.00-0ubuntu2~22.04.0
    • 20231004.02-0ubuntu1~22.04.1
    • 20231004.02-0ubuntu1~22.04.2
    • 20231004.02-0ubuntu1~22.04.3
    Affected ranges
    • ECOSYSTEM: < 20231004.02-0ubuntu1~22.04.4

    Update to 20231004.02-0ubuntu1~22.04.4

  • google-osconfig-agent Ubuntu:22.04:LTS

    Versions
    • 20210608.1-0ubuntu1
    • 20210608.1-0ubuntu2
    • 20210608.1-0ubuntu3
    • 20220824.00-0ubuntu1~22.04.1
    • 20220824.00-0ubuntu1~22.04.2
    • 20230504.00-0ubuntu1~22.04.0
    Affected ranges
    • ECOSYSTEM: < 20230504.00-0ubuntu1~22.04.1

    Update to 20230504.00-0ubuntu1~22.04.1

  • golang-google-protobuf Ubuntu:24.04:LTS

    Versions
    • 1.28.1-3build1
    • 1.31.0-1
    • 1.32.0-1
    • 1.32.0-1ubuntu0.1
    • 1.32.0-1ubuntu0.2
    • 1.32.0-1ubuntu0.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:24.04:LTS

    Versions
    • 20230426.00-0ubuntu3
    • 20231004.02-0ubuntu1
    • 20231004.02-0ubuntu3
    • 20240213.00-0ubuntu1
    • 20240213.00-0ubuntu2
    • 20240213.00-0ubuntu3
    Affected ranges
    • ECOSYSTEM: < 20240213.00-0ubuntu3.1

    Update to 20240213.00-0ubuntu3.1

  • google-osconfig-agent Ubuntu:24.04:LTS

    Versions
    • 20230504.00-0ubuntu2
    • 20230504.00-0ubuntu3
    • 20240320.00-0ubuntu1~24.04.0
    Affected ranges
    • ECOSYSTEM: < 20240320.00-0ubuntu1~24.04.1

    Update to 20240320.00-0ubuntu1~24.04.1

  • golang-google-protobuf Ubuntu:25.10

    Versions
    • 1.36.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-protobuf Ubuntu:26.10

    Versions
    • 1.36.7-1
    • 1.36.10-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-protobuf Ubuntu:26.04:LTS

    Versions
    • 1.36.5-1
    • 1.36.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →