{"id":"CVE-2024-24786","revision":"20aa69f2a2e34be191d7aa936b1f9b65","records":[{"revision":"20aa69f2a2e34be191d7aa936b1f9b65","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-24786","aliases":[],"title":"Infinite loop in JSON unmarshaling in google.golang.org/protobuf","description":"The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.","state":0,"publishedAt":"2024-03-05T22:22:35.299+00:00","modifiedAt":"2026-09-23T13:51:15.891+00:00","affected":[{"ecosystem":"https://pkg.go.dev","name":"google.golang.org/protobuf/encoding/protojson","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"google.golang.org/protobuf\",\n                    \"product\": \"google.golang.org/protobuf/encoding/protojson\",\n                    \"collectionURL\": \"https://pkg.go.dev\",\n                    \"packageName\": \"google.golang.org/protobuf/encoding/protojson\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.33.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"UnmarshalOptions.unmarshal\"\n                        },\n                        {\n                            \"name\": \"Unmarshal\"\n                        },\n                        {\n                            \"name\": \"UnmarshalOptions.Unmarshal\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"https://pkg.go.dev","name":"google.golang.org/protobuf/internal/encoding/json","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"google.golang.org/protobuf\",\n                    \"product\": \"google.golang.org/protobuf/internal/encoding/json\",\n                    \"collectionURL\": \"https://pkg.go.dev\",\n                    \"packageName\": \"google.golang.org/protobuf/internal/encoding/json\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.33.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"Decoder.Read\"\n                        },\n                        {\n                            \"name\": \"Decoder.Peek\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://go.dev/cl/569356","https://pkg.go.dev/vuln/GO-2024-2611","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU/","http://www.openwall.com/lists/oss-security/2024/03/08/4","https://security.netapp.com/advisory/ntap-20240517-0002/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-24786","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-24786","identifiers":["CVE-2024-24786"]},"retained":false,"historicalAffected":[]}],"coverage":[]}