CVE-2026-54270

CVE-2026-54270 concerns protobufjs, where versions 8.2.0–8.4.2 preserved unknown wire elements in message.$unknowns during binary decode and lacked a decode-time option to discard them. This could allow crafted protobuf payloads with many unknown fields to cause decoded messages to retain memory ...

DEBIAN-CVE-2024-24786

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...