Infinite loop in JSON unmarshaling in google.golang.org/protobuf

CVE-2024-24786

What is CVE-2024-24786?

An issue has been identified in Google's Protocol Buffers where the protojson.Unmarshal function can enter an infinite loop if it encounters certain types of invalid JSON data. This may particularly occur when trying to unmarshal into a message that contains a google.protobuf.Any value or when the UnmarshalOptions.DiscardUnknown parameter is activated. Such behavior could lead to performance degradation or application freeze, making it vital for developers to implement proper input validation when handling JSON with Protocol Buffers.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References