CVE-2024-7254: protobuf-java Denial of Service Vulnerability
Summary
CVE-2024-7254: protobuf-java has potential Denial of Service issue. Affects com.google.protobuf:protobuf-java across 3 version ranges.
< 3.25.5
>= 4.0.0.rc.1, < 4.27.5
>= 4.28.0.rc.1, < 4.28.2
Fixed in 3.25.5, 4.27.5 or 4.28.2, depending on the release line you run. How to fix ↓
Also tracked for
- protobuf · Debian:11
The same CVE-2024-7254 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
protobuf-java is a widely used library for serializing structured data in Java applications. It allows developers to define data structures and automatically generate code for encoding and decoding these structures. The library is known for its efficiency and performance, making it a popular choice for applications that require data interchange. However, it is susceptible to a Denial of Service (DoS) vulnerability when parsing unknown fields, which can lead to application crashes.
Vulnerability Detail
The vulnerability arises from the way protobuf-java handles unknown fields during message parsing. A maliciously crafted message can trigger a StackOverflow error due to unbounded recursion when nested groups are parsed as unknown fields. This can lead to a Denial of Service, as the application may crash or become unresponsive. The issue affects all versions of the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which rely on the Java Protobuf runtime.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.25.53.25.5 -
>= 4.0.0.rc.1, < 4.27.54.27.5 -
>= 4.28.0.rc.1, < 4.28.24.28.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid parsing unknown fields if possible, or implement strict validation of incoming messages to prevent malicious payloads from being processed. This can help mitigate the risk until the library is updated.
Conclusion
CVE-2024-7254 is a significant vulnerability in the protobuf-java library that can lead to Denial of Service attacks. It is crucial for developers using this library to update to the latest versions to mitigate the risk. Additionally, employing workarounds can help protect applications until updates are applied.
See every vulnerability recorded for com.google.protobuf:protobuf-java →
FAQ
CVE-2024-7254 is a high-severity vulnerability in the protobuf-java library that can lead to a Denial of Service due to unbounded recursion when parsing unknown fields.
All versions of protobuf-java, protobuf-javalite, protobuf-kotlin, and protobuf-kotlin-lite are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your pom.xml. You can also check your application using the Vulert playground without any signup.
The CVSS score of CVE-2024-7254 is 7.5, indicating a high severity level.
If immediate updates are not possible, implement strict validation of incoming messages and avoid parsing unknown fields as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.google.protobuf:protobuf-java.
