CVE-2024-24786

HighCVSS 7.5

Published: 05/03/2024(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.26%

68th percentile - higher than 68% of all known CVEs

Summary

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This can occur when unmarshaling into a message containing a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

Risk Assessment

An infinite loop can cause application hangs or resource exhaustion, potentially leading to denial of service.

Recommendation

Update the protobuf library to a patched version and avoid using the DiscardUnknown option if possible.

Other vulnerabilities in Google protobuf

CVE-2026-89418High
google-protobuf contains unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to a Node.js service calling deserializeBinary(), causing a RangeError: Maximum call stack size exceeded and crashing the process.

Original NVD description (English source)

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS