CVE-2024-24786:
Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON
7.5
CVSS ScoreBasic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
Published
3/6/2024
Updated
11/7/2024
KEV Status
No
Technology
Go
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
google.golang.org/protobuf | go | < 1.33.0 | 1.33.0 |
google.golang.org/protobuf/encoding/protojson | go | < 1.33.0 | 1.33.0 |
google.golang.org/protobuf/internal/encoding/json | go | < 1.33.0 | 1.33.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability CVE-2024-24786 describes an infinite loop in protojson.Unmarshal
. The provided commit f01a588e5810b90996452eec4a28f22a0afae023
addresses this.
protojson.Unmarshal
is identified as the primary affected function based on the vulnerability description. The loop occurs within its execution.- The patch modifies
encoding/protojson.(*decoder).skipJSONValue
by adding a check forjson.EOF
with a comment explicitly stating it's to 'Avoid an infinite loop'. This indicatesskipJSONValue
was directly involved in the loop. - The patch also modifies
internal/encoding/json.(*Decoder).Read
to correctly handle malformed JSON object closing tokens. The commit message explains this change fixes error handling for inputs like{"":}
. Incorrect parsing byRead
could lead to the conditions causing the infinite loop in higher-level functions likeskipJSONValue
or within the broaderUnmarshal
logic. Therefore,Unmarshal
is the entry point, and the loop was caused by issues in its dependent functionsskipJSONValue
andDecoder.Read
when processing specific invalid JSON inputs.