CVE-2024-7254

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

Summary

When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.

Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team [email protected]

Affected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

Severity

CVE-2024-7254 High CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication) This is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

Proof of Concept

For reproduction details, please refer to the unit tests (Protobuf Java LiteTest and CodedInputStreamTest) that identify the specific inputs that exercise this parsing weakness.

Remediation and Mitigation

We have been working diligently to address this issue and have released a mitigation that is available now. Please update to the latest available versions of the following packages:

• protobuf-java (3.25.5, 4.27.5, 4.28.2)
• protobuf-javalite (3.25.5, 4.27.5, 4.28.2)
• protobuf-kotlin (3.25.5, 4.27.5, 4.28.2)
• protobuf-kotlin-lite (3.25.5, 4.27.5, 4.28.2)
• com-protobuf [JRuby gem only] (3.25.5, 4.27.5, 4.28.2)

Protocol Buffers (a.k.a., protobuf) are Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data. You can find protobuf's documentation on the Google Developers site.

Security Fix(es):

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.(CVE-2024-7254)

Red Hat Lightwell has released com.google.protobuf:protobuf-kotlin 3.21.7.rhlw-00002 with a backported security fix.

CVE-2024-7254: Stack overflow in Protocol Buffers Java Lite

This patched artifact is a drop-in replacement for com.google.protobuf:protobuf-kotlin 3.21.7 from Maven Central.

Red Hat Lightwell has released com.google.protobuf:protobuf-java-util 3.21.7.rhlw-00002 with a backported security fix.

CVE-2024-7254: Stack overflow in Protocol Buffers Java Lite

This patched artifact is a drop-in replacement for com.google.protobuf:protobuf-java-util 3.21.7 from Maven Central.

Red Hat Lightwell has released com.google.protobuf:protobuf-kotlin-lite 3.21.7.rhlw-00002 with a backported security fix.

CVE-2024-7254: Stack overflow in Protocol Buffers Java Lite

This patched artifact is a drop-in replacement for com.google.protobuf:protobuf-kotlin-lite 3.21.7 from Maven Central.

Red Hat Lightwell has released com.google.protobuf:protobuf-java 3.21.7.rhlw-00002 with a backported security fix.

CVE-2024-7254: Stack overflow in Protocol Buffers Java Lite

This patched artifact is a drop-in replacement for com.google.protobuf:protobuf-java 3.21.7 from Maven Central.

Red Hat Lightwell has released com.google.protobuf:protobuf-javalite 3.21.7.rhlw-00002 with a backported security fix.

CVE-2024-7254: Stack overflow in Protocol Buffers Java Lite

This patched artifact is a drop-in replacement for com.google.protobuf:protobuf-javalite 3.21.7 from Maven Central.

Root has patched CVE-2024-7254 in the com.google.protobuf:protobuf-java package for Root:Maven. Multiple fixed versions available.

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

TuxCare rebuilt com.google.protobuf:protobuf-java to address 2 CVEs. Fixed in 2.5.0-tuxcare.1.

• CVE-2024-7254: prevent stack overflow by limiting recursion depth when parsing nested Protocol Buffers data

TuxCare rebuilt com.google.protobuf:protobuf-java to address 2 CVEs. Fixed in 2.6.1-tuxcare.1.

TuxCare rebuilt 4 com.google.protobuf packages to address 1 CVE. Fixed in 3.21.1-tuxcare.1.

TuxCare rebuilt 4 com.google.protobuf packages to address 1 CVE. Fixed in 3.21.9-tuxcare.2.

TuxCare rebuilt 4 com.google.protobuf packages to address 1 CVE. Fixed in 3.19.6-tuxcare.1.

• SECURITY UPDATE: Unbounded recursion when parsing nested groups in protobuf-java
  • debian/patches/CVE-2024-7254.patch: bound the depth of the skipMessage()/skipField() recursion in CodedInputStream and of the nested-group recursion in UnknownFieldSetLite with the existing recursion limit, so a stream of nested SGROUP tags can no longer exhaust the Java stack
  • CVE-2024-7254
• SECURITY UPDATE: Nested Any messages bypass the JSON parser recursion depth limit in python-protobuf
  • debian/patches/CVE-2026-0994.patch: add max_recursion_depth accounting to json_format and route nested well-known types in _ConvertAnyMessage() through ConvertMessage() so the depth is tracked
  • CVE-2026-0994

TuxCare rebuilt com.google.protobuf:protobuf-java to address 2 CVEs. Fixed in 3.7.1-tuxcare.1.

TuxCare rebuilt com.google.protobuf:protobuf-java to address 2 CVEs. Fixed in 3.6.1-tuxcare.1.

TuxCare rebuilt 4 com.google.protobuf packages to address 1 CVE. Fixed in 3.21.12-tuxcare.1.

TuxCare rebuilt 2 com.google.protobuf packages to address 3 CVEs. Fixed in 3.12.0-tuxcare.1.

TuxCare rebuilt 2 com.google.protobuf packages to address 2 CVEs. Fixed in 3.16.1-tuxcare.1.

TuxCare rebuilt 4 com.google.protobuf packages to address 1 CVE. Fixed in 3.21.7-tuxcare.1.

TuxCare rebuilt 4 com.google.protobuf packages to address 2 CVEs. Fixed in 3.19.2-tuxcare.1.

TuxCare rebuilt 2 com.google.protobuf packages to address 3 CVEs. Fixed in 3.12.2-tuxcare.1.

These are all security issues fixed in the libprotobuf-lite28_3_0-28.3-15.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2024-7254 in the rootio-protobuf package for Root:Alpine:3.20. Multiple fixed versions available.

This update for protobuf fixes the following issues:

• CVE-2024-7254: Fixed stack overflow vulnerability in Protocol Buffer (bsc#1230778)

This update for protobuf fixes the following issues:

• CVE-2024-7254: Fixed stack overflow vulnerability in Protocol Buffer (bsc#1230778)

This update for protobuf fixes the following issues:

• CVE-2024-7254: Fixed stack overflow vulnerability in Protocol Buffer (bsc#1230778)

This update for protobuf fixes the following issues:

• CVE-2024-7254: Fixed a stack overflow vulnerability in protocol buffers (bsc#1230778)

This update for protobuf fixes the following issues:

• CVE-2024-2410: Use after free when parsing JSON from a stream (bsc#1223947).
• CVE-2024-7254: StackOverflow vulnerability in Protocol Buffers (bsc#1230778).
• CVE-2025-4565: Parsing of untrusted Protocol Buffers data containing an arbitrary number of recursive groups or messages can lead to crash due to RecursionError (bsc#1244663).

It was discovered that Protocol Buffers incorrectly handled memory when receiving malicious input using the Java bindings. An attacker could possibly use this issue to cause a denial of service.

It was discovered that Protocol Buffers incorrectly handled memory when receiving malicious input using the Python bindings. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-4565)

It was discovered that Protocol Buffers incorrectly handled memory when receiving malicious input using the Java bindings. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.04. (CVE-2024-7254)

USN-7435-1 and USN-7629-1 fixed vulnerabilities in Protocol Buffers for several releases of Ubuntu. This update provides the corresponding fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.

Original advisory details:

It was discovered that Protocol Buffers incorrectly handled memory when receiving malicious input using the Python bindings. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-4565)

It was discovered that Protocol Buffers incorrectly handled memory when receiving malicious input using the Java bindings. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.04. (CVE-2024-7254)