Panic when parsing invalid messages in google.golang.org/protobuf

CVE-2023-24535

What is CVE-2023-24535?

A vulnerability in Go Protobuf allows for a panic condition when parsing certain text-format messages. Specifically, when the message contains a negative sign followed by whitespace and no additional content, it leads to undesirable behavior. This can cause disruptions in applications that depend on proper message parsing and handling, emphasizing the need for robust input validation.

References