GHSA-8r3f-844c-mc37Published
Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON
Exact source revision recorded 24 Oct 2026 13:19:41 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2024-24786 · Microsoft / collected KEV context
osv · GHSA-8r3f-844c-mc37
- https://nvd.nist.gov/vuln/detail/CVE-2024-24786
- https://github.com/protocolbuffers/protobuf-go/commit/f01a588e5810b90996452eec4a28f22a0afae023
- https://github.com/protocolbuffers/protobuf-go
- https://github.com/protocolbuffers/protobuf-go/releases/tag/v1.33.0
- https://go.dev/cl/569356
- https://lists.fedoraproject.org/archives/list/[email protected]/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU
- https://pkg.go.dev/vuln/GO-2024-2611
- https://security.netapp.com/advisory/ntap-20240517-0002
- http://www.openwall.com/lists/oss-security/2024/03/08/4
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.