GHSA-hw7c-3rfg-p46jHighCVSS 7.5

google.golang.org/protobuf vulnerable to panic leading to denial of service

Published
March 14, 2023
Last Modified
May 20, 2024

🔗 CVE IDs covered (1)

CVE-2023-24535 →

📋 Description

Parsing invalid messages can panic.

Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.

🎯 Affected products1

  • go/google.golang.org/protobuf:>= 1.29.0, < 1.29.1

🔗 References (5)