GO-2024-2611

Source
https://pkg.go.dev/vuln/GO-2024-2611
Import Source
https://vuln.go.dev/ID/GO-2024-2611.json
Aliases
Published
2024-03-05T20:24:05Z
Modified
2024-04-05T15:41:42Z
Details

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

References

Affected packages

Go / google.golang.org/protobuf

Package

Name
google.golang.org/protobuf

Affected ranges

Type
SEMVER
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.33.0

Ecosystem specific 

{
    "imports": [
        {
            "path": "google.golang.org/protobuf/encoding/protojson",
            "symbols": [
                "Unmarshal",
                "UnmarshalOptions.Unmarshal",
                "UnmarshalOptions.unmarshal"
            ]
        },
        {
            "path": "google.golang.org/protobuf/internal/encoding/json",
            "symbols": [
                "Decoder.Peek",
                "Decoder.Read"
            ]
        }
    ]
}