https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:52:26 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-07527 bdu:2024-07527 https://cve.radiocsirt.org/vuln/bdu:2024-07527 https://cve.radiocsirt.org/vuln/bell-cve-2024-7254 <p><strong>Affected:</strong> Alpaquita:23: protobuf, Alpaquita:stream: protobuf, BellSoft Hardened Containers:stream: protobuf</p> <p><strong>Affected:</strong> Alpaquita:23: protobuf, Alpaquita:stream: protobuf, BellSoft Hardened Containers:stream: protobuf</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-7254 https://cve.radiocsirt.org/vuln/brew-dexter-cve-2024-7254 <p><strong>Affected:</strong> Homebrew: dexter</p> <p>### Summary When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.</p> <p>Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team &lt;ecosystem@trailofbits.com&gt;</p> <p>Affected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.</p> <p>### Severity [CVE-2024-7254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254) **High** CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication) This is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.</p> <p>### Proof of Concept For reproduction details, please refer to the unit tests (Protobuf Java [LiteTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/lite/src/test/java/com/google/protobuf/LiteTest.java) and [CodedInputStreamTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/core/src/test/java/com/google/protobuf/CodedInputStreamTest.java)) that identify the specific inputs that exercise this parsing weakness.</p> <p>### Remediation and Mitigation We have been working diligently to address this issue and have released a mitigation that i…</p> <p><strong>Affected:</strong> Homebrew: dexter</p> <p>### Summary When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.</p> <p>Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team &lt;ecosystem@trailofbits.com&gt;</p> <p>Affected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.</p> <p>### Severity [CVE-2024-7254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254) **High** CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication) This is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.</p> <p>### Proof of Concept For reproduction details, please refer to the unit tests (Protobuf Java [LiteTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/lite/src/test/java/com/google/protobuf/LiteTest.java) and [CodedInputStreamTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/core/src/test/java/com/google/protobuf/CodedInputStreamTest.java)) that identify the specific inputs that exercise this parsing weakness.</p> <p>### Remediation and Mitigation We have been working diligently to address this issue and have released a mitigation that i…</p> https://cve.radiocsirt.org/vuln/brew-dexter-cve-2024-7254 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0890 certfr-2024-avi-0890 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0890 https://cve.radiocsirt.org/vuln/cleanstart-2026-cl03013 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: apache-hive</p> <p>Multiple security vulnerabilities affect the apache-hive package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: apache-hive</p> <p>Multiple security vulnerabilities affect the apache-hive package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-cl03013 https://cve.radiocsirt.org/vuln/euvd-2026-252117 EUVD-2026-252117 https://cve.radiocsirt.org/vuln/euvd-2026-252117 https://cve.radiocsirt.org/vuln/fkie_cve-2024-7254 <p>Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.</p> <p>Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-7254 https://cve.radiocsirt.org/vuln/ghsa-735f-pc8j-v9w8 <p><strong>Affected:</strong> Maven: com.google.protobuf:protobuf-java, Maven: com.google.protobuf:protobuf-javalite, Maven: com.google.protobuf:protobuf-kotlin, Maven: com.google.protobuf:protobuf-kotlin-lite, RubyGems: google-protobuf</p> <p>### Summary When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.</p> <p>Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team &lt;ecosystem@trailofbits.com&gt;</p> <p>Affected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.</p> <p>### Severity [CVE-2024-7254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254) **High** CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication) This is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.</p> <p>### Proof of Concept For reproduction details, please refer to the unit tests (Protobuf Java [LiteTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/lite/src/test/java/com/google/protobuf/LiteTest.java) and [CodedInputStreamTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/core/src/test/java/com/google/protobuf/CodedInputStreamTest.java)) that identify the specific inputs that exercise this parsing weakness.</p> <p>### Remediation and Mitigation We have been working diligently to address this issue and have released a mitigation that i…</p> <p><strong>Affected:</strong> Maven: com.google.protobuf:protobuf-java, Maven: com.google.protobuf:protobuf-javalite, Maven: com.google.protobuf:protobuf-kotlin, Maven: com.google.protobuf:protobuf-kotlin-lite, RubyGems: google-protobuf</p> <p>### Summary When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.</p> <p>Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team &lt;ecosystem@trailofbits.com&gt;</p> <p>Affected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.</p> <p>### Severity [CVE-2024-7254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254) **High** CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication) This is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.</p> <p>### Proof of Concept For reproduction details, please refer to the unit tests (Protobuf Java [LiteTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/lite/src/test/java/com/google/protobuf/LiteTest.java) and [CodedInputStreamTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/core/src/test/java/com/google/protobuf/CodedInputStreamTest.java)) that identify the specific inputs that exercise this parsing weakness.</p> <p>### Remediation and Mitigation We have been working diligently to address this issue and have released a mitigation that i…</p> https://cve.radiocsirt.org/vuln/ghsa-735f-pc8j-v9w8 https://cve.radiocsirt.org/vuln/msrc_cve-2024-7254 msrc_CVE-2024-7254 https://cve.radiocsirt.org/vuln/msrc_cve-2024-7254 https://cve.radiocsirt.org/vuln/oesa-2025-1144 <p><strong>Affected:</strong> openEuler:24.03-LTS: protobuf</p> <p>Protocol Buffers (a.k.a., protobuf) are Google&amp;amp;apos;s language-neutral, platform-neutral, extensible mechanism for serializing structured data. You can find protobuf&amp;amp;apos;s documentation on the Google Developers site. Security Fix(es):</p> <p>Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.(CVE-2024-7254)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: protobuf</p> <p>Protocol Buffers (a.k.a., protobuf) are Google&amp;amp;apos;s language-neutral, platform-neutral, extensible mechanism for serializing structured data. You can find protobuf&amp;amp;apos;s documentation on the Google Developers site. Security Fix(es):</p> <p>Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.(CVE-2024-7254)</p> https://cve.radiocsirt.org/vuln/oesa-2025-1144 https://cve.radiocsirt.org/vuln/opensuse-su-2025:14832-1 <p>libprotobuf-lite28_3_0-28.3-15.1 on GA media</p> <p>libprotobuf-lite28_3_0-28.3-15.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14832-1 https://cve.radiocsirt.org/vuln/rhsa-2024:10700 <p>protobuf: StackOverflow vulnerability in Protocol Buffers kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider org.springframework:spring-webmvc: Path traversal vulnerability in functional web frameworks</p> <p>protobuf: StackOverflow vulnerability in Protocol Buffers kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider org.springframework:spring-webmvc: Path traversal vulnerability in functional web frameworks</p> https://cve.radiocsirt.org/vuln/rhsa-2024:10700 https://cve.radiocsirt.org/vuln/suse-su-2024:3745-1 <p>Security update for protobuf</p> <p>Security update for protobuf</p> https://cve.radiocsirt.org/vuln/suse-su-2024:3745-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-7254 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: protobuf, Ubuntu:Pro:16.04:LTS: protobuf, Ubuntu:Pro:18.04:LTS: protobuf, Ubuntu:Pro:20.04:LTS: protobuf, Ubuntu:22.04:LTS: protobuf, Ubuntu:24.04:LTS: protobuf</p> <p>Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: protobuf, Ubuntu:Pro:16.04:LTS: protobuf, Ubuntu:Pro:18.04:LTS: protobuf, Ubuntu:Pro:20.04:LTS: protobuf, Ubuntu:22.04:LTS: protobuf, Ubuntu:24.04:LTS: protobuf</p> <p>Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-7254 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3147 <p>Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Red Hat-Produkten ausnutzen, um Dateien zu manipulieren, beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen.</p> <p>Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Red Hat-Produkten ausnutzen, um Dateien zu manipulieren, beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3147