CVE-2024-7254: Stack overflow in Protocol Buffers Java Lite

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-19 · updated 2026-06-17
Weakness: CWE-400

Description

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

Affected products

Python Protobuf: before 3.25.5; from 4.0.0 before 4.27.5; from 4.28.0 before 4.28.2 — fixed in 3.25.5, 4.27.5, 4.28.2
Google protobuf-java: before 3.25.5; from 4.0.0 before 4.27.5; from 4.28.0 before 4.28.2 — fixed in 3.25.5, 4.27.5, 4.28.2
Google protobuf-javalite: before 3.25.5; from 4.0.0 before 4.27.5; from 4.28.0 before 4.28.2 — fixed in 3.25.5, 4.27.5, 4.28.2
Google protobuf-kotlin: before 3.25.5; from 4.0.0 before 4.27.5; from 4.28.0 before 4.28.2 — fixed in 3.25.5, 4.27.5, 4.28.2
Google Protobuf-Kotlin-Lite: before 3.25.5; from 4.0.0 before 4.27.5; from 4.28.0 through 4.28.2 — fixed in 3.25.5, 4.27.5
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
NetApp Bluexp: all versions
NetApp Ontap Tools: 10

How to fix

Upgrade to a fixed version: Python Protobuf 3.25.5, 4.27.5, 4.28.2; Google protobuf-java 3.25.5, 4.27.5, 4.28.2; Google protobuf-javalite 3.25.5, 4.27.5, 4.28.2; Google protobuf-kotlin 3.25.5, 4.27.5, 4.28.2; Google Protobuf-Kotlin-Lite 3.25.5, 4.27.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-7254 or the next vulnerability affects your stack