CVE-2024-24786: Infinite loop in JSON unmarshaling in google.golang.org/protobuf
Published Mar 5, 2024
·Updated
Last updated 18 September 2024
Affected Software
11 affected componentsFixes available
debian/golang-google-protobuf<=1.25.0+git20201208.160c747-1, <=1.28.1-3
1.33.0-1
go/google.golang.org/protobuf/internal/encoding/json<1.33.0
1.33.0
go/google.golang.org/protobuf/encoding/protojson<1.33.0
1.33.0
go/google.golang.org/protobuf<1.33.0
1.33.0
F5 BIG-IP Next Central Manager>=20.2.0<=20.2.1
F5 BIG-IP Next SPK>=1.7.0<=1.9.2
F5 BIG-IP Next CNF>=1.1.0<=1.3.1
F5 F5OS-A=1.7.0, >=1.5.1<=1.5.2
1.5.3
F5 F5OS-C>=1.6.0<=1.6.2
redhat/google.golang.org/protobuf<1.33.0
1.33.0
IBM watsonx.data<=2.2- 2.3.1
Event History
Mar 5, 2024
CVE Published
via MITRE·10:22 PM
Data Sourced
via MITRE·10:22 PM
DescriptionWeakness
Data Sourced
via NVD·11:15 PM
DescriptionSeverity
Mar 6, 2024
Advisory Published
via GitHub·12:31 AM
Data Sourced
via Red Hat·06:49 AM
DescriptionSeverityAffected Software
Jun 29, 2024
Data Sourced
via Launchpad·09:47 PM
Description
Sep 20, 2024
Advisory Published
via F5·08:52 PM
Sep 21, 2024
Data Sourced
via Ubuntu·09:57 PM
RemedyDescriptionSeverityAffected Software
May 9, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-24786?
CVE-2024-24786 is categorized as a denial of service vulnerability due to an infinite loop flaw in the rotojson.Unmarshal function.
2
How do I fix CVE-2024-24786?
To fix CVE-2024-24786, update the affected software packages to version 1.33.0 or later.
3
What software is affected by CVE-2024-24786?
CVE-2024-24786 affects the golang-google-protobuf package and certain versions of F5 and IBM products.
4
Can CVE-2024-24786 be exploited remotely?
Yes, CVE-2024-24786 can be exploited remotely by sending specially crafted requests that trigger the infinite loop.
5
What impact does CVE-2024-24786 have on systems?
The impact of CVE-2024-24786 is that it can cause a denial of service, potentially rendering the affected service unresponsive.