Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 8 products
🟠 protobufjs, Denial of Service (DoS) via Uncontrolled Recursion, #CVE-2024-7254 (Medium) https://dailycve.com/protobufjs-denial-of-service-dos-via-uncontrolled-recursion-cve-2024-7254-medium/
Post summary
A new advice has been released disclosing a DoS vulnerability in protobufjs (CVE‑2024‑7254) caused by uncontrolled recursion.
10 of 10 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | protobuf | - | ruby | - | |
| App | protobuf-java | - | - | - | |
| App | protobuf-javalite | - | - | - | |
| App | protobuf-kotlin | - | - | - | |
| App | protobuf-kotlin-lite | - | - | - | |
| App | netapp | active_iq_unified_manager | - | linux | - |
| App | netapp | active_iq_unified_manager | - | vmware_vsphere | - |
| App | netapp | active_iq_unified_manager | - | windows | - |
| App | netapp | bluexp | - | - | - |
| App | netapp | ontap_tools | 10 | vmware_vsphere | - |