CVE-2024-7254: Stack overflow in Protocol Buffers Java Lite

Vulnerability summary

CVE-2024-7254 is a high (CVSS 8.7) Uncontrolled Resource Consumption vulnerability in google google-protobuf [jruby gem]. EPSS estimates a 2.77% chance of exploitation in the next 30 days, higher than 86.3% of scored vulnerabilities.

Timeline

1. 19-09-2024
   PublishedVulnerability first disclosed.
2. 08-09-2025
   Last modifiedVulnerability information updated.

Description

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.