GO-2024-2611

Infinite loop in JSON unmarshaling in google.golang.org/protobuf

At a glance

Published: 2024-03-05 20:24 UTC
Updated: 2026-10-14 10:56 UTC
CVE: CVE-2024-24786
Aliases: GHSA-8r3f-844c-mc37

Description

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

Affected packages

Package	Versions
Go · google.golang.org/protobuf	introduced 0, fixed 1.33.0

References

https://go.dev/cl/569356 FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database