GO-2021-0053

Panic due to improper input validation in github.com/gogo/protobuf

At a glance

Published: 2021-04-14 20:04 UTC
Updated: 2026-02-04 03:28 UTC
CVE: CVE-2021-3121
Aliases: BIT-consul-2021-3121, BIT-protobuf-2021-3121, GHSA-c3h9-896r-86jm

Description

Due to improper bounds checking, maliciously crafted input to generated Unmarshal methods can cause an out-of-bounds panic. If parsing messages from untrusted parties, this may be used as a denial of service vector.

Affected packages

Package	Versions
Go · github.com/gogo/protobuf	introduced 0, fixed 1.3.2

References

https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database