CVE-2024-7254
Stack overflow in Protocol Buffers Java Lite
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 19, 2024
- Updated
- Sep 8, 2025
- Reserved
- Jul 29, 2024
Description
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Protocol BuffersGoogle |
|
protobuf-javaGoogle |
|
protobuf-javaliteGoogle |
|
protobuf-kotlinGoogle |
|
protobuf-kotllin-liteGoogle |
|
google-protobuf [JRuby Gem]Google |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.