{"id":"CVE-2024-24786","sourceIdentifier":"security@golang.org","published":"2024-03-05T23:15:07.820","lastModified":"2026-09-23T14:17:06.307","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set."},{"lang":"es","value":"La función protojson.Unmarshal puede entrar en un bucle infinito al descomponer ciertas formas de JSON no válido. Esta condición puede ocurrir al descomponer en un mensaje que contiene un valor google.protobuf.Any, o cuando la opción UnmarshalOptions.DiscardUnknown está configurada."}],"affected":[{"source":"security@golang.org","affectedData":[{"vendor":"google.golang.org/protobuf","product":"google.golang.org/protobuf/encoding/protojson","defaultStatus":"unaffected","collectionURL":"https://pkg.go.dev","packageName":"google.golang.org/protobuf/encoding/protojson","programRoutines":[{"name":"UnmarshalOptions.unmarshal"},{"name":"Unmarshal"},{"name":"UnmarshalOptions.Unmarshal"}],"versions":[{"version":"0","lessThan":"1.33.0","versionType":"semver","status":"affected"}]},{"vendor":"google.golang.org/protobuf","product":"google.golang.org/protobuf/internal/encoding/json","defaultStatus":"unaffected","collectionURL":"https://pkg.go.dev","packageName":"google.golang.org/protobuf/internal/encoding/json","programRoutines":[{"name":"Decoder.Read"},{"name":"Decoder.Peek"}],"versions":[{"version":"0","lessThan":"1.33.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-11-07T16:22:27.828054Z","id":"CVE-2024-24786","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"references":[{"url":"http://www.openwall.com/lists/oss-security/2024/03/08/4","source":"security@golang.org"},{"url":"https://go.dev/cl/569356","source":"security@golang.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU/","source":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2024-2611","source":"security@golang.org"},{"url":"https://security.netapp.com/advisory/ntap-20240517-0002/","source":"security@golang.org"},{"url":"http://www.openwall.com/lists/oss-security/2024/03/08/4","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://go.dev/cl/569356","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://pkg.go.dev/vuln/GO-2024-2611","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20240517-0002/","source":"af854a3a-2127-422b-91ae-364da2661108"}]}