CVE-2024-7254

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-7254
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-7254.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-7254
Aliases
Downstream
BELL (1)
CGA (384)
CLEANSTART (24)
CLSA (6)
DEBIAN (1)
ECHO (1)
MINI (12)
OESA (1)
openSUSE (1)
RHLW (5)
RHSA (4)
ROOT (2)
SUSE (5)
UBUNTU (1)
Related
openSUSE (1)
SUSE (5)
Published
2024-09-19T00:18:45Z
Modified
2026-10-22T15:55:36Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Stack overflow in Protocol Buffers Java Lite
Details

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

Database specific 
{
    "cna_assigner": "Google",
    "cwe_ids": [
        "CWE-400",
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7254.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "4.27.5"
                        },
                        {
                            "fixed": "4.28.2"
                        },
                        {
                            "fixed": "4.27.5"
                        },
                        {
                            "fixed": "4.28.2"
                        },
                        {
                            "fixed": "4.27.5"
                        },
                        {
                            "fixed": "4.28.2"
                        },
                        {
                            "fixed": "4.27.5"
                        },
                        {
                            "fixed": "4.28.2"
                        },
                        {
                            "fixed": "4.27.5"
                        },
                        {
                            "fixed": "4.28.2"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/protocolbuffers/protobuf

Affected ranges

Type
GIT
Repo
https://github.com/protocolbuffers/protobuf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9d0ec0f92b5b5fdeeda11f9dcecc1872ff378014
Fixed
cc8b3483a5584b3301e3d43d17eb59704857ffaa
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:google:protobuf:*:*:*:*:*:ruby:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "3.25.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:google:protobuf-java:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "3.25.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:google:protobuf-javalite:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "3.25.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:google:protobuf-kotlin:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "3.25.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:google:protobuf-kotlin-lite:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "3.25.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "cc8b3483a5584b3301e3d43d17eb59704857ffaa"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v2.*
v2.6.0
v2.6.1rc1
v25.*
v25.0-rc1
Other
v26-dev
v27-dev
v28-dev
v3.*
v3.0.0-alpha-3
v3.0.0-alpha-4
v3.0.0-beta-1
v3.0.0-beta-1-bzl-fix
v3.0.0-beta-2
v3.0.0-beta-3-pre-1
v3.12.3
v3.20.0-rc2
v3.25.0-rc1
v4.*
v4.25.0-rc1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-7254.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "187699666725553001969903735843994537532",
                "55306071626887955823303766262560698223",
                "74584313714193226701178778011701277881",
                "147749986059702625189561456237485046506",
                "74823940619903515778371050986420796194",
                "265665398887781583308524351206282095442",
                "239720152912315002222994748187684200603",
                "310196590678153343607164611204813127461",
                "74823940619903515778371050986420796194",
                "265665398887781583308524351206282095442",
                "239720152912315002222994748187684200603"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-7254-7a965aa2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
        "target": {
            "file": "java/core/src/main/java/com/google/protobuf/MessageSchema.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "124163967352246688214546229473473883455",
                "300713614716662775751458287037321463210",
                "294268701189291199123888170460374916188",
                "24961642600297195342164888948858260154",
                "129317413791818856815644527685599871799"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-7254-8cf66719",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
        "target": {
            "file": "java/core/src/main/java/com/google/protobuf/ArrayDecoders.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "92273624040218165778987697797792380720",
                "81525801942758895160828723104013261995",
                "241044337175306843160308758859746429129",
                "160531667966112287605753022255151236614",
                "100435754983116611431478047320981963593",
                "324837249835571934525420407386979029348",
                "24734704794166928727777614298399665820",
                "86118173199264051695381862993566979662",
                "139515334792916736183679688177651617388",
                "251135687449804296650880880240700788623",
                "239974696282359619535496261995776110048",
                "42957001103383622642059814999783710523",
                "110848489944646821233482879575670719863"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-7254-9988d8d4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
        "target": {
            "file": "java/lite/src/test/java/com/google/protobuf/LiteTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "331837591212601565404889112357441580747",
                "6848830727921630298366094500443245455",
                "337032765652427255037688029722863516341",
                "109853233186423233996409611364920863013",
                "159204753246371336798510571774129811201",
                "333810459316441745068039040687153935672",
                "15475016457827397842140856676540627879"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-7254-9c51baed",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
        "target": {
            "file": "java/core/src/main/java/com/google/protobuf/UnknownFieldSchema.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "280155160883867168633966633787872132746",
                "249270040444639382789703269790216933115",
                "483488570655035415058762629769103926",
                "159460365723612061991314749211322806383"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-7254-be705a3b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
        "target": {
            "file": "java/core/src/main/java/com/google/protobuf/InvalidProtocolBufferException.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "193954467700084152208333944298167438950",
            "length": 191
        },
        "id": "CVE-2024-7254-c632972f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa",
        "target": {
            "file": "java/core/src/main/java/com/google/protobuf/InvalidProtocolBufferException.java",
            "function": "recursionLimitExceeded"
        }
    }
]
vanir_signatures_modified 
"2026-10-22T15:55:36Z"