VYPR
← All advisories
High severity7.5GHSA Advisory· Published Mar 5, 2024· Updated Apr 15, 2026

CVE-2024-24786

CVE-2024-24786

Description

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
google.golang.org/protobufGo
< 1.33.01.33.0
google.golang.org/protobuf/encoding/protojsonGo
< 1.33.01.33.0
google.golang.org/protobuf/internal/encoding/jsonGo
< 1.33.01.33.0

Affected products

2238

Patches

Vulnerability mechanics

References

11

News mentions

0

No linked articles in our index yet.