Spotted what might be an issue in go.mod around line 1.
The project pins google.golang.org/protobuf at v1.31.0. In this version, protojson.Unmarshal may enter an infinite loop when processing malformed JSON (e.g., messages containing a google.protobuf.Any field or when UnmarshalOptions.DiscardUnknown is enabled). An attacker can cause a denial‑of‑service by supplying crafted JSON that never returns, leading to high availability risk. The vulnerability is classified as CVE‑2024‑24786 with a MEDIUM severity in the scanner but effectively a high risk due to the potential DoS. Updating to version 1.33.0 (or later) resolves the loop bug.
Something like this might fix it:
*** Begin Patch
*** Update File: go.mod
@@
-require google.golang.org/protobuf v1.31.0
+// Updated to include the fix for CVE‑2024‑24786 (infinite‑loop in protojson.Unmarshal)
+require google.golang.org/protobuf v1.33.0
*** End Patch
For reference: rule CVE-2024-24786. Rated high.
If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
go.modaround line 1.The project pins google.golang.org/protobuf at v1.31.0. In this version,
protojson.Unmarshalmay enter an infinite loop when processing malformed JSON (e.g., messages containing agoogle.protobuf.Anyfield or whenUnmarshalOptions.DiscardUnknownis enabled). An attacker can cause a denial‑of‑service by supplying crafted JSON that never returns, leading to high availability risk. The vulnerability is classified as CVE‑2024‑24786 with a MEDIUM severity in the scanner but effectively a high risk due to the potential DoS. Updating to version 1.33.0 (or later) resolves the loop bug.Something like this might fix it:
For reference: rule
CVE-2024-24786. Rated high.If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.