golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON

🗓️ 03 Sep 2024 11:45:04Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 4 Views

Golang protobuf unmarshal can loop on invalid inputs with Any or DiscardUnknown.

Reporter	Title	Published	Views	Family All 1074
RedhatCVE	CVE-2024-24786	6 Mar 202407:12	–	redhatcve
RedHat Linux	Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.13.42 security and extras update	23 May 202406:22	–	redhat
RedHat Linux	Low: Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.12.1-394 Security Update	23 May 202414:09	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: container-tools:rhel8 security update	22 May 202411:48	–	redhat
RedHat Linux	golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON	22 May 202411:48	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Migration Toolkit for Applications security and bug fix update	23 May 202406:39	–	redhat
RedHat Linux	Moderate: Red Hat Security Advisory: Kube Descheduler Operator for Red Hat OpenShift 5.0.1 for RHEL 9	1 Jul 202400:52	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Red Hat OpenShift distributed tracing 3.2.0 operator/operand containers update	5 Jun 202405:15	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update	5 Jun 202414:47	–	redhat
RedHat Linux	golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON	5 Jun 202414:47	–	redhat

Vulners

Node

AND

redhat openshift_buildsRange<1.1el9

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2024-24786
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/569356
groups	www.groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-24786
pkg	www.pkg.go.dev/vuln/GO-2024-2611
cve	www.cve.org/CVERecord

17 Jul 2026 16:30Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.5

EPSS0.01262

SSVC

go protobuf parsing error infinite loop invalid input any type discard unknown