CVE-2024-7254
HIGH EPSS 84.5%
Published Sep 19, 20241y ago · Modified Jun 17, 20261w ago
8.7 CVSS 4.0
Published Sep 19, 2024 1y ago
Last Modified Jun 17, 2026 1w ago
Description
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
84.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 3
CWE-400 Uncontrolled Resource Consumption Resource Mgmt
CWE-674
CWE-787 Out-of-bounds Write Memory Safety
Affected Products 20
| Vendor | Product | Version | Range |
|---|---|---|---|
| protobuf | * | <3.25.5 | |
| protobuf | * | ≥4.0.0 – <4.27.5 | |
| protobuf | * | ≥4.28.0 – <4.28.2 | |
| protobuf-java | * | <3.25.5 | |
| protobuf-java | * | ≥4.0.0 – <4.27.5 | |
| protobuf-java | * | ≥4.28.0 – <4.28.2 | |
| protobuf-javalite | * | <3.25.5 | |
| protobuf-javalite | * | ≥4.0.0 – <4.27.5 | |
| protobuf-javalite | * | ≥4.28.0 – <4.28.2 | |
| protobuf-kotlin | * | <3.25.5 | |
| protobuf-kotlin | * | ≥4.0.0 – <4.27.5 | |
| protobuf-kotlin | * | ≥4.28.0 – <4.28.2 | |
| protobuf-kotlin-lite | * | <3.25.5 | |
| protobuf-kotlin-lite | * | ≥4.0.0 – <4.27.5 | |
| protobuf-kotlin-lite | * | ≥4.28.0 – ≤4.28.2 | |
| netapp | active_iq_unified_manager | * | any |
| netapp | active_iq_unified_manager | * | any |
| netapp | active_iq_unified_manager | * | any |
| netapp | bluexp | * | any |
| netapp | ontap_tools | 10 | any |
References 3
- github.com https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa
- security.netapp.com https://security.netapp.com/advisory/ntap-20241213-0010/
- security.netapp.com https://security.netapp.com/advisory/ntap-20250418-0006/
Remediation
- github.com https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa