CVE-2024-7254: protobuf-java has potential Denial of Service issue
7.5
Basic Information
JavaTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.google.protobuf:protobuf-java | maven | < 3.25.5 | 3.25.5 |
| com.google.protobuf:protobuf-javalite | maven | < 3.25.5 | 3.25.5 |
| com.google.protobuf:protobuf-kotlin | maven | < 3.25.5 | 3.25.5 |
| com.google.protobuf:protobuf-kotlin-lite | maven | < 3.25.5 | 3.25.5 |
| google-protobuf | rubygems | < 3.25.5 | 3.25.5 |
| google-protobuf | rubygems | >= 4.0.0.rc.1, < 4.27.5 | 4.27.5 |
| google-protobuf | rubygems | >= 4.28.0.rc.1, < 4.28.2 | 4.28.2 |
| com.google.protobuf:protobuf-kotlin-lite | maven | >= 4.0.0.rc.1, < 4.27.5 | 4.27.5 |
| com.google.protobuf:protobuf-kotlin-lite | maven | >= 4.28.0.rc.1, < 4.28.2 | 4.28.2 |
| com.google.protobuf:protobuf-kotlin | maven | >= 4.0.0.rc.1, < 4.27.5 | 4.27.5 |
| com.google.protobuf:protobuf-kotlin | maven | >= 4.28.0.rc.1, < 4.28.2 | 4.28.2 |
| com.google.protobuf:protobuf-javalite | maven | >= 4.0.0.rc.1, < 4.27.5 | 4.27.5 |
| com.google.protobuf:protobuf-javalite | maven | >= 4.28.0.rc.1, < 4.28.2 | 4.28.2 |
| com.google.protobuf:protobuf-java | maven | >= 4.0.0.rc.1, < 4.27.5 | 4.27.5 |
| com.google.protobuf:protobuf-java | maven | >= 4.28.0.rc.1, < 4.28.2 | 4.28.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability is a Denial of Service caused by stack overflow due to unbounded recursion when parsing protobuf messages with deeply nested unknown groups. I analyzed the provided commit patches, focusing on changes that introduced recursion depth counters and limits. The functions where these checks were added are considered the previously vulnerable functions.
Key functions identified are those directly involved in decoding/merging unknown fields (especially groups), such as com.google.protobuf.ArrayDecoders.decodeUnknownField and com.google.protobuf.UnknownFieldSchema.mergeOneFieldFrom / com.google.protobuf.UnknownFieldSchema.mergeFrom. Additionally, com.google.protobuf.CodedInputStream.skipMessage was patched as skipping deeply nested structures could also trigger the vulnerability. Functions for merging known message and group fields (com.google.protobuf.ArrayDecoders.mergeMessageField, com.google.protobuf.ArrayDecoders.mergeGroupField) also received recursion checks, indicating they could be part of problematic recursion chains, though the vulnerability description emphasizes 'unknown fields'.