CVE-2024-24786 — Infinite loop in JSON unmarshaling in google.golang.org/protobuf

Affected: google.golang.org/protobuf/encoding/protojson, google.golang.org/protobuf/internal/encoding/json

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

GHSA-f6x5-jh6r-wrfv — golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read

Affected: Go: golang.org/x/crypto

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

Most recent entries from all

CVE-2024-24786 — Infinite loop in JSON unmarshaling in google.golang.org/protobuf

GHSA-f6x5-jh6r-wrfv — golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read