CVE-2024-24786
Last modified
CVE-2024-24786 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.. EPSS estimates a 1.26% chance of exploitation in the next 30 days.
Description
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-24786?
How severe is CVE-2024-24786?
How do I fix CVE-2024-24786?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-24780Remote Code Execution with untrusted URI of UDF vulnerabilit…9.8
- CVE-2024-24781An unauthenticated remote attacker can use an uncontrolled r…7.5
- CVE-2024-24782An unauthenticated attacker can send a ping request from one…4.3
- CVE-2024-24783Verifying a certificate chain which contains a certificate w…5.9
- CVE-2024-24784The ParseAddressList function incorrectly handles comments (…7.5
- CVE-2024-24785If errors returned from MarshalJSON methods contain user con…5.4
- CVE-2024-24787On Darwin, building a Go module which contains CGO can trigg…6.4
- CVE-2024-24788A malformed DNS message in response to a query can cause the…5.9
- CVE-2024-24789The archive/zip package's handling of certain types of inval…5.5
- CVE-2024-2479A vulnerability classified as problematic has been found in …3.5
- CVE-2024-24790The various Is methods (IsPrivate, IsLoopback, etc) did not …9.8
- CVE-2024-24791The net/http HTTP/1.1 client mishandled the case where a ser…7.5
Are you affected by CVE-2024-24786?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST