Stack Overflow Vulnerability in Protobuf Package: CVE-2024-7254
Summary
CVE-2024-7254: Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. Affects protobuf across 2 version ranges.
< 9d0ec0f92b5b5fdeeda11f9dcecc1872ff378014
< cc8b3483a5584b3301e3d43d17eb59704857ffaa
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Protobuf package, widely used for serializing structured data, is integral to many applications that require efficient data interchange. It supports various programming languages and is designed to be extensible and efficient. However, the package is vulnerable to a critical issue that arises when parsing untrusted Protocol Buffers data, particularly when it contains nested groups or SGROUP tags.
Vulnerability Detail
CVE-2024-7254 is a vulnerability that allows an attacker to exploit the Protobuf package by sending specially crafted Protocol Buffers data. This data can contain an arbitrary number of nested groups or SGROUP tags, leading to a StackOverflow error due to unbounded recursion during parsing. The vulnerability is particularly concerning when using DiscardUnknownFieldsParser or the Java Protobuf Lite parser, as well as when dealing with Protobuf map fields. If exploited, this vulnerability can cause applications to crash, leading to denial of service.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, update the Protobuf package to a version that includes the fix for CVE-2024-7254. You can do this by running the following command in your terminal:
sudo apt-get update
sudo apt-get install protobuf
Ensure that you are using a version that is patched against this vulnerability, specifically any version after commit cc8b3483a5584b3301e3d43d17eb59704857ffaa.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot immediately update the Protobuf package, consider implementing input validation to restrict the depth of nested groups in Protocol Buffers data. This can help mitigate the risk of StackOverflow errors until a proper update can be applied.
Conclusion
CVE-2024-7254 represents a significant vulnerability in the Protobuf package that can lead to application crashes due to StackOverflow errors. It is crucial for developers to update their Protobuf installations to mitigate this risk and ensure the stability and security of their applications.
See every vulnerability recorded for protobuf →
FAQ
CVE-2024-7254 is a vulnerability in the Protobuf package that can lead to a StackOverflow error when parsing untrusted Protocol Buffers data with excessive nesting.
Exploitation of this vulnerability can cause your application to crash, resulting in a denial of service and potentially exposing sensitive data.
All versions of the Protobuf package prior to the fix introduced in commit cc8b3483a5584b3301e3d43d17eb59704857ffaa are vulnerable.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software by analyzing your manifest file like package-lock.json. You can also check your application using the Vulert playground without any signup.
Implement input validation to limit the depth of nested groups in Protocol Buffers data as a temporary workaround until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for protobuf.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.