Stack overflow in Protocol Buffers Java Lite
Vulnerability Description
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-7254
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Alexis Challande, Trail of Bits Ecosystem Security Team <ecosystem@trailofbits.com>
References
More from Google
View All →Affected Vendor
