GitHub Advisoryadvisory · Go
GHSA-hw7c-3rfg-p46j google.golang.org/protobuf vulnerable to panic leading to denial of service
HIGH
Official page ↗
- Aliases
- CVE-2023-24535
- Ecosystem
- Go
- Packages
- google.golang.org/protobuf
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-125
- Reviewed
- 2023-03-14
Affected packages
• Go google.golang.org/protobuf: >= 1.29.0, < 1.29.1 → fixed in 1.29.1
Description
Parsing invalid messages can panic.
Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.
Related
Alias · CVE (1)
- CVE-2023-24535 Parsing invalid messages can panic. vulnerability
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness