Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-24535

Panic when parsing invalid messages in google.golang.org/protobuf

Description

Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

google.golang.org/protobuf google.golang.org/protobuf/encoding/prototext

Default version status: unaffected

  • 1.29.0 to < 1.29.1affected

google.golang.org/protobuf google.golang.org/protobuf/internal/encoding/text

Default version status: unaffected

  • 1.29.0 to < 1.29.1affected

References