{"id":"GO-2024-2611","revision":"43171a774a28489c887306a2666e6c3c","records":[{"revision":"43171a774a28489c887306a2666e6c3c","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2024-2611","aliases":["CVE-2024-24786","GHSA-8r3f-844c-mc37"],"title":"Infinite loop in JSON unmarshaling in google.golang.org/protobuf","description":"The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.","state":0,"publishedAt":"2024-03-05T20:24:05+00:00","modifiedAt":"2026-10-14T10:56:59.7521457+00:00","affected":[{"ecosystem":"Go","name":"google.golang.org/protobuf","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.33.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://go.dev/cl/569356"],"sourceUrl":"https://osv.dev/vulnerability/GO-2024-2611","license":"OSV · upstream source license applies","key":"osv:GO-2024-2611","identifiers":["GO-2024-2611","CVE-2024-24786","GHSA-8r3f-844c-mc37"]},"retained":false,"historicalAffected":[]}],"coverage":[]}