CVE-2024-24786

🗓️ 05 Mar 2024 23:15:00Reported by ubuntu.comType

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON, which can occur when unmarshaling into a message containing a google.protobuf.Any value or when the UnmarshalOptions.DiscardUnknown option is set

Reporter	Title	Published	Views	Family All 1076
RedhatCVE	CVE-2024-24786	6 Mar 202407:12	–	redhatcve
RedHat Linux	Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.13 bug fix and security update	15 May 202418:40	–	redhat
RedHat Linux	Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.12.57 security update	16 May 202416:12	–	redhat
RedHat Linux	Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.13.42 security and extras update	23 May 202406:22	–	redhat
RedHat Linux	Low: Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.12.1-394 Security Update	23 May 202414:09	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: container-tools:rhel8 security update	22 May 202411:48	–	redhat
RedHat Linux	golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON	22 May 202411:48	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Migration Toolkit for Applications security and bug fix update	23 May 202406:39	–	redhat
RedHat Linux	Moderate: Red Hat Security Advisory: Kube Descheduler Operator for Red Hat OpenShift 5.0.1 for RHEL 9	1 Jul 202400:52	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Red Hat OpenShift distributed tracing 3.2.0 operator/operand containers update	5 Jun 202405:15	–	redhat

OS	OS Version	Architecture	Package	Package Version	Filename
Ubuntu	22.04	all	google-guest-agent	20231004.2-0ubuntu1~22.4.4	google-guest-agent_20231004.2-0ubuntu1~22.4.4_all.deb
Ubuntu	22.04	all	google-osconfig-agent	20230504.0-0ubuntu1~22.4.1	google-osconfig-agent_20230504.0-0ubuntu1~22.4.1_all.deb
Ubuntu	24.04	all	google-guest-agent	20240213.0-0ubuntu3.1	google-guest-agent_20240213.0-0ubuntu3.1_all.deb
Ubuntu	24.04	all	google-osconfig-agent	20240320.0-0ubuntu1~24.4.1	google-osconfig-agent_20240320.0-0ubuntu1~24.4.1_all.deb

Source	Link
ubuntu	www.ubuntu.com/security/CVE-2024-24786
go-review	www.go-review.googlesource.com/c/protobuf/+/569356
go	www.go.dev/cl/569356
pkg	www.pkg.go.dev/vuln/GO-2024-2611
cve	www.cve.org/CVERecord
ubuntu	www.ubuntu.com/security/notices/USN-6746-1
ubuntu	www.ubuntu.com/security/notices/USN-6746-2

23 Jul 2026 17:41Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.5

EPSS0.01262

SSVC