p PatchFirst

CVE-2024-7254

CVE-2024-7254 · Stack overflow in Protocol Buffers Java Lite

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

CVSS 8.7 · High · EPSS 2.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • protocol buffers

    Versions
    • ≥ 0, < 28.2: Affected (custom)

    Update to 28.2

  • protobuf-java

    Versions
    • ≥ 0, < 3.25.5: Affected (custom)
    • ≥ 0, < 4.27.5: Affected (custom)
    • ≥ 0, < 4.28.2: Affected (custom)

    Update to 3.25.5

  • protobuf-javalite

    Versions
    • ≥ 0, < 3.25.5: Affected (custom)
    • ≥ 0, < 4.27.5: Affected (custom)
    • ≥ 0, < 4.28.2: Affected (custom)

    Update to 3.25.5

  • protobuf-kotlin

    Versions
    • ≥ 0, < 3.25.5: Affected (custom)
    • ≥ 0, < 4.27.5: Affected (custom)
    • ≥ 0, < 4.28.2: Affected (custom)

    Update to 3.25.5

  • protobuf-kotllin-lite

    Versions
    • ≥ 0, < 3.25.5: Affected (custom)
    • ≥ 0, < 4.27.5: Affected (custom)
    • ≥ 0, < 4.28.2: Affected (custom)

    Update to 3.25.5

  • google-protobuf [jruby gem]

    Versions
    • ≥ 0, < 3.25.5: Affected (custom)
    • ≥ 0, < 4.27.5: Affected (custom)
    • ≥ 0, < 4.28.2: Affected (custom)

    Update to 3.25.5

  • protobuf Debian:12

    Versions
    • 3.21.12-3
    Affected ranges
    • ECOSYSTEM: < 3.21.12-3+deb12u1

    Update to 3.21.12-3+deb12u1

  • protobuf Debian:13

    Versions
    • 3.21.12-11
    Affected ranges
    • ECOSYSTEM: < 3.21.12-11+deb13u1

    Update to 3.21.12-11+deb13u1

  • protobuf Debian:14

    Versions
    • 3.21.12-11
    Affected ranges
    • ECOSYSTEM: < 3.21.12-12

    Update to 3.21.12-12

  • protobuf Ubuntu:Pro:14.04:LTS

    Versions
    • 2.4.1-3ubuntu2
    • 2.4.1-3ubuntu3
    • 2.4.1-3ubuntu4
    • 2.5.0-5ubuntu2
    • 2.5.0-7ubuntu1
    • 2.5.0-8ubuntu1
    • 2.5.0-9ubuntu1
    • 2.5.0-9ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • protobuf Ubuntu:Pro:16.04:LTS

    Versions
    • 2.6.1-1.2
    • 2.6.1-1.3
    • 2.6.1-1.3ubuntu0.1~esm1
    • 2.6.1-1.3ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: < 2.6.1-1.3ubuntu0.1~esm4

    Update to 2.6.1-1.3ubuntu0.1~esm4

  • protobuf Ubuntu:Pro:18.04:LTS

    Versions
    • 3.0.0-9ubuntu5
    • 3.0.0-9ubuntu6
    • 3.0.0-9.1ubuntu1
    • 3.0.0-9.1ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 3.0.0-9.1ubuntu1.1+esm3

    Update to 3.0.0-9.1ubuntu1.1+esm3

  • protobuf Ubuntu:Pro:20.04:LTS

    Versions
    • 3.6.1.3-2
    • 3.6.1.3-2ubuntu1
    • 3.6.1.3-2ubuntu3
    • 3.6.1.3-2ubuntu4
    • 3.6.1.3-2ubuntu5
    • 3.6.1.3-2ubuntu5.2
    Affected ranges
    • ECOSYSTEM: < 3.6.1.3-2ubuntu5.2+esm2

    Update to 3.6.1.3-2ubuntu5.2+esm2

  • protobuf Ubuntu:22.04:LTS

    Versions
    • 3.12.4-1ubuntu3
    • 3.12.4-1ubuntu5
    • 3.12.4-1ubuntu6
    • 3.12.4-1ubuntu7
    • 3.12.4-1ubuntu7.22.04.1
    Affected ranges
    • ECOSYSTEM: < 3.12.4-1ubuntu7.22.04.2

    Update to 3.12.4-1ubuntu7.22.04.2

  • protobuf Ubuntu:24.04:LTS

    Versions
    • 3.21.12-7ubuntu1
    • 3.21.12-8ubuntu1
    • 3.21.12-8ubuntu5
    • 3.21.12-8.2
    • 3.21.12-8.2build1
    Affected ranges
    • ECOSYSTEM: < 3.21.12-8.2ubuntu0.1

    Update to 3.21.12-8.2ubuntu0.1

Original sources

Check your server →