High severity · published Sep 19, 2024
CVE-2024-7254
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e
7.5
CVSS
2.8%
EPSS
No
On KEV
Description
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
BL
Bluexp · Netapp
All versions, or not specified · source: NVD
OT
Ontap Tools · Netapp
10 · source: NVD
PR
Protobuf · Google
before 3.25.5; 4.0.0 before 4.27.5; 4.28.0 before 4.28.2 · source: NVD
PR
Protobuf-java · Google
before 3.25.5; 4.0.0 before 4.27.5; 4.28.0 before 4.28.2 · source: NVD
PR
Protobuf-javalite · Google
before 3.25.5; 4.0.0 before 4.27.5; 4.28.0 before 4.28.2 · source: NVD
PR
Protobuf-kotlin · Google
before 3.25.5; 4.0.0 before 4.27.5; 4.28.0 before 4.28.2 · source: NVD
PR
Protobuf-kotlin-lite · Google
before 3.25.5; 4.0.0 before 4.27.5; 4.28.0 through 4.28.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7254
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7254
Patch
https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa
Third Party Advisory
https://security.netapp.com/advisory/ntap-20241213-0010/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20250418-0006/
More from Protobuf
9.8
CVE-2024-2410
The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream
8.8
CVE-2015-5237
protobuf allows remote authenticated attackers to cause a heap-based buffer overflow
7.5
CVE-2026-0994
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested…
5.5
CVE-2021-22570
Nullptr dereference when a null char is present in a proto symbol