Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-protobufamazon-linux-ami-2-upgrade-protobuf-compileramazon-linux-ami-2-upgrade-protobuf-debuginfoamazon-linux-ami-2-upgrade-protobuf-develamazon-linux-ami-2-upgrade-protobuf-emacsamazon-linux-ami-2-upgrade-protobuf-emacs-elamazon-linux-ami-2-upgrade-protobuf-javaamazon-linux-ami-2-upgrade-protobuf-javadocamazon-linux-ami-2-upgrade-protobuf-liteamazon-linux-ami-2-upgrade-protobuf-lite-develamazon-linux-ami-2-upgrade-protobuf-lite-staticamazon-linux-ami-2-upgrade-protobuf-pythonamazon-linux-ami-2-upgrade-protobuf-staticamazon-linux-ami-2-upgrade-protobuf-vim | Nov 18, 2024 | Sep 19, 2024 | |
| Atlassian Bitbucket | atlassian-bitbucket-upgrade-latest | Dec 12, 2025 | Dec 11, 2025 | |
| Atlassian Jira | atlassian-jira-upgrade-latest | May 15, 2025 | Feb 18, 2025 | |
| Debian | no-fix-debian-deb-package | May 15, 2025 | Sep 19, 2024 | |
| Ibm Was | ibm-was-upgrade-latest | Nov 11, 2024 | Sep 19, 2024 | |
| Red Hat Jboss Eap | red-hat-jboss-eap-upgrade-latest | Dec 20, 2024 | Sep 19, 2024 | |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Sep 19, 2024 |
| Suse | — | suse-upgrade-libprotobuf-lite25_1_0suse-upgrade-libprotobuf-lite25_1_0-32bitsuse-upgrade-libprotobuf25_1_0suse-upgrade-libprotobuf25_1_0-32bitsuse-upgrade-libprotoc25_1_0suse-upgrade-libprotoc25_1_0-32bitsuse-upgrade-protobuf-develsuse-upgrade-protobuf-javasuse-upgrade-python311-protobuf | Dec 30, 2024 | Sep 19, 2024 |
| Ubuntu | ubuntu-upgrade-libprotobuf-javaubuntu-upgrade-python3-protobuf | Apr 15, 2025 | Sep 19, 2024 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Sep 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub