скеName Overflow Vulnerability in Protocol Buffers

CVE-2024-7254

What is CVE-2024-7254?

A vulnerability exists in Google Protocol Buffers where projects parsing untrusted Protocol Buffers data containing nested groups or multiple SGROUP tags risk exceeding the stack limit, leading to stack overflow. This occurs when the parsing method, using either DiscardUnknownFieldsParser or Java Protobuf Lite parser, processes unknown fields or Protobuf map fields, resulting in unbounded recursion that can be exploited by an attacker. Proper validations and limitations are critical to mitigate potential risks.

References