Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade protobufUpgrade protobuf-liteUpgrade protobuf-staticUpgrade protobuf-emacsUpgrade protobuf-javaUpgrade protobuf-javadocUpgrade protobuf-lite-develUpgrade protobuf-develUpgrade protobuf-lite-staticUpgrade protobuf-debuginfoUpgrade protobuf-emacs-elUpgrade protobuf-vimUpgrade protobuf-pythonUpgrade protobuf-compiler | Nov 18, 2024 | Sep 19, 2024 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Dec 12, 2025 | Dec 11, 2025 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Feb 18, 2025 |
| Debian | — | No solution existsUpgrade protobuf | May 15, 2025 | Sep 19, 2024 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Nov 11, 2024 | Sep 19, 2024 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Dec 20, 2024 | Sep 19, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 19, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.8Upgrade Splunk Enterprise to version 10.0.1Upgrade Splunk Enterprise to version 9.3.6Upgrade Splunk Enterprise to version 9.4.4 | Jul 30, 2026 | Sep 19, 2024 |
| Suse | — | Upgrade libprotoc25_1_0-32bitUpgrade protobuf-javaUpgrade protobuf-develUpgrade libprotoc25_1_0Upgrade libprotobuf25_1_0-32bitUpgrade libprotobuf25_1_0Upgrade libprotobuf-lite25_1_0-32bitUpgrade python311-protobufUpgrade libprotobuf-lite25_1_0 | Dec 30, 2024 | Sep 19, 2024 |
| Ubuntu | — | Upgrade libprotobuf-javaUpgrade python3-protobuf | Apr 15, 2025 | Sep 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub