{"id":"CVE-2024-24786","title":"The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON","summary":"The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptio…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-1286"],"vendor":"google.golang.org/protobuf","product":"google.golang.org/protobuf/encoding/protojson","affected":["google.golang.org/protobuf/encoding/protojson < 1.33.0","google.golang.org/protobuf/internal/encoding/json < 1.33.0"],"published":"2024-03-05","updated":"2026-09-23","sourceUpdated":"2026-09-23T14:17:06.307","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-24786","references":[{"url":"http://www.openwall.com/lists/oss-security/2024/03/08/4","label":"security@golang.org"},{"url":"https://go.dev/cl/569356","label":"security@golang.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU/","label":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2024-2611","label":"security@golang.org"},{"url":"https://security.netapp.com/advisory/ntap-20240517-0002/","label":"security@golang.org"},{"url":"http://www.openwall.com/lists/oss-security/2024/03/08/4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://go.dev/cl/569356","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://pkg.go.dev/vuln/GO-2024-2611","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20240517-0002/","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2024-11-07T16:22:27.828054Z"},"epss":0.01262,"epssPercentile":0.68348,"ingestedAt":"2026-09-23T14:25:29.762Z","slug":"CVE-2024-24786","body":"## Overview\n\nThe protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}