Stack overflow in Protocol Buffers Java Lite
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 28.2, 3.25.5, 4.27.5, 4.28.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- Google Protocol Buffers
fixed in 28.2
- Google protobuf-java
fixed in 3.25.5; fixed in 4.27.5; fixed in 4.28.2
- Google protobuf-javalite
fixed in 3.25.5; fixed in 4.27.5; fixed in 4.28.2
- Google protobuf-kotlin
fixed in 3.25.5; fixed in 4.27.5; fixed in 4.28.2
- Google protobuf-kotllin-lite
fixed in 3.25.5; fixed in 4.27.5; fixed in 4.28.2
- Google google-protobuf [JRuby Gem]
fixed in 3.25.5; fixed in 4.27.5; fixed in 4.28.2
- com.google.protobuf:protobuf-javaMaven
fixed in 3.25.5
- com.google.protobuf:protobuf-javaliteMaven
fixed in 3.25.5
- com.google.protobuf:protobuf-kotlinMaven
fixed in 3.25.5
- com.google.protobuf:protobuf-kotlin-liteMaven
fixed in 3.25.5
- google-protobufRubyGems
fixed in 3.25.5
- google-protobufRubyGems
From 4.0.0.rc.1 · fixed in 4.27.5
- google-protobufRubyGems
From 4.28.0.rc.1 · fixed in 4.28.2
- com.google.protobuf:protobuf-kotlin-liteMaven
From 4.0.0-RC1 · fixed in 4.27.5
- com.google.protobuf:protobuf-kotlin-liteMaven
From 4.28.0-RC1 · fixed in 4.28.2
- com.google.protobuf:protobuf-kotlinMaven
From 4.0.0-RC1 · fixed in 4.27.5
- com.google.protobuf:protobuf-kotlinMaven
From 4.28.0-RC1 · fixed in 4.28.2
- com.google.protobuf:protobuf-javaliteMaven
From 4.0.0-RC1 · fixed in 4.27.5
- com.google.protobuf:protobuf-javaliteMaven
From 4.28.0-RC1 · fixed in 4.28.2
- com.google.protobuf:protobuf-javaMaven
From 4.0.0-RC1 · fixed in 4.27.5
- com.google.protobuf:protobuf-javaMaven
From 4.28.0-RC1 · fixed in 4.28.2