Skip to content
Fencer Vulns
high 7.5

CVE-2024-7254 json

Stack overflow in Protocol Buffers Java Lite

published 2024-09-19 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-2741 , GHSA-735f-pc8j-v9w8

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.8%
EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

Patch / fix

  • maven com.google.protobuf:protobuf-java 3.25.5, 4.27.5, 4.28.2
  • maven com.google.protobuf:protobuf-javalite 3.25.5, 4.27.5, 4.28.2
  • maven com.google.protobuf:protobuf-kotlin 3.25.5, 4.27.5, 4.28.2
  • maven com.google.protobuf:protobuf-kotlin-lite 3.25.5, 4.27.5, 4.28.2
  • rubygems google-protobuf 3.25.5, 4.27.5, 4.28.2
  • Google Protocol Buffers 28.2
  • Google protobuf-java 3.25.5, 4.27.5, 4.28.2
  • Google protobuf-javalite 3.25.5, 4.27.5, 4.28.2
  • Google protobuf-kotlin 3.25.5, 4.27.5, 4.28.2
  • Google protobuf-kotllin-lite 3.25.5, 4.27.5, 4.28.2
  • Google google-protobuf [JRuby Gem] 3.25.5, 4.27.5, 4.28.2
  • google protobuf 28.2
  • google protobuf-kotlin-lite 3.25.5, 4.27.5, 4.28.2
  • protobuf Debian 12 3.21.12-3+deb12u1
  • protobuf Debian 13 3.21.12-11+deb13u1
  • protobuf Debian 14 3.21.12-12

debian advisories DEBIAN-CVE-2024-7254

  • protobuf Ubuntu 22.04 LTS 3.12.4-1ubuntu7.22.04.2
  • protobuf Ubuntu 24.04 LTS 3.21.12-8.2ubuntu0.1
  • protobuf Ubuntu Pro 16.04 LTS 2.6.1-1.3ubuntu0.1~esm4
  • protobuf Ubuntu Pro 18.04 LTS 3.0.0-9.1ubuntu1.1+esm3
  • protobuf Ubuntu Pro 20.04 LTS 3.6.1.3-2ubuntu5.2+esm2

ubuntu advisories UBUNTU-CVE-2024-7254

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • eap7-netty jboss enterprise application platform els 7.4 4.1.124-1.Final_redhat_00001.1.el8eap
  • eap7-wildfly jboss enterprise application platform els 7.4 7.4.24-4.GA_redhat_00002.1.el8eap
  • eap7-undertow jboss enterprise application platform els 7.4 2.2.39-1.Final_redhat_00001.1.el8eap
  • eap7-hibernate jboss enterprise application platform els 7.4 5.3.38-1.Final_redhat_00001.1.el8eap
  • eap7-netty-all jboss enterprise application platform els 7.4 4.1.124-1.Final_redhat_00001.1.el8eap
  • eap7-apache-cxf jboss enterprise application platform els 7.4 3.5.11-1.SP1_redhat_00001.1.el8eap
  • eap7-netty-codec jboss enterprise application platform els 7.4 4.1.124-1.Final_redhat_00001.1.el8eap
  • eap7-eclipse-jgit jboss enterprise application platform els 7.4 5.13.5.202508271544-2.r_redhat_00001.1.el8eap

red hat advisories RHSA-2026:4916RHSA-2026:4917RHSA-2026:4915RHSA-2025:20052

  • protobuf Linux Micro 6.1 23.4-slfo.1.1_2.1
  • protobuf Linux Micro 6.0 23.4-8.1
  • protobuf SLE Module for Python 3 15 SP5, SLE Module for Public Cloud 15 SP5, SLE Module for Package Hub 15 SP5 +6 more 25.1-150500.12.5.1
  • protobuf SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Module for Public Cloud 15 SP4 +6 more 25.1-150400.9.10.1
  • protobuf SLE Module for Python 3 15 SP6, SLE Module for Package Hub 15 SP6, SLE Module for Development Tools 15 SP6 +2 more 25.1-150600.16.7.1

suse advisories SUSE-SU-2025:20672-1SUSE-SU-2025:20074-1SUSE-SU-2024:3747-1SUSE-SU-2024:3746-1SUSE-SU-2024:3745-1

  • protobuf openSUSE Tumbleweed 28.3-15.1

opensuse advisories openSUSE-SU-2025:14832-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-7254 updated cvss 7.5

protobuf: StackOverflow vulnerability in Protocol Buffers

  • Red Hat AMQ Broker 7 protobuf-java
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 2 protobuf-java
    affected: workaround, no fix available
  • Red Hat build of Debezium 2 protobuf-java Red Hat Data Grid 8 protobuf-java
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 6 mysql, mysql-libs, mysql-test, mysql-bench, mysql-server, mysql-embedded
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AI (RHEL AI) bootc-nvidia-rhel9, instructlab-nvidia-rhel9 Red Hat Fuse 7 protobuf-java Red Hat Integration Camel K 1 protobuf-java
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack protobuf-java
    affected: workaround, no fix available
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel8, rhoai/odh-trustyai-service-rhel8
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenStack Platform 16.2 protobuf, python3-protobuf
    affected: workaround, no fix available
show 15 more
  • Red Hat Process Automation 7 protobuf-java
    affected: workaround, no fix planned “Will not fix”
  • Red Hat streams for Apache Kafka protobuf-java
    affected: workaround, no fix available
  • Red Hat build of Apache Camel 4 for Quarkus 3
    fixed: vendor fix RHSA-2024:7972
  • Red Hat build of Apache Camel 4.4.3 for Spring Boot
    fixed: vendor fix RHSA-2024:8064
  • Red Hat build of Apache Camel 4.8 for Spring Boot
    fixed: vendor fix RHSA-2024:10700
  • Red Hat build of Quarkus Native builder
    fixed: vendor fix RHSA-2024:7676
  • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-wildfly 7.4.23-5.GA_redhat_00004.1.el7eap, eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-protostream 4.3.7-1.Final_redhat_00001.1.el7eap, eap7-wildfly-modules 7.4.23-5.GA_redhat_00004.1.el7eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-wildfly-javadocs 7.4.23-5.GA_redhat_00004.1.el7eap, +7 more
    fixed: vendor fix RHSA-2026:4915
  • Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-wildfly 7.4.23-5.GA_redhat_00004.1.el8eap, eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-protostream 4.3.7-1.Final_redhat_00001.1.el8eap, eap7-wildfly-modules 7.4.23-5.GA_redhat_00004.1.el8eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-javadocs 7.4.23-5.GA_redhat_00004.1.el8eap, +9 more Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-wildfly 7.4.23-5.GA_redhat_00004.1.el9eap, eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-protostream 4.3.7-1.Final_redhat_00001.1.el9eap, eap7-wildfly-modules 7.4.23-5.GA_redhat_00004.1.el9eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-javadocs 7.4.23-5.GA_redhat_00004.1.el9eap, +9 more
    fixed: vendor fix RHSA-2025:20052
  • Red Hat JBoss EAP XP 5.0 Update 2.0
    fixed: vendor fix RHSA-2025:7620
  • Red Hat JBoss Enterprise Application Platform 7.4.24 protostream 4.3.7.Final-redhat-00001
    fixed: vendor fix RHSA-2025:20057
  • Red Hat Trusted Profile Analyzer 1.2 rhtpa 1.2.1-1733575106, rhtpa 1.2.1-1733826968
    fixed: fixed in 1.2.1 RHSA-2024:11256
  • Red Hat Streams for Apache Kafka 2.8.0
    fixed: vendor fix RHSA-2024:9571
  • Red Hat build of OptaPlanner 8 protobuf-java
    not affected: component not present
  • Red Hat Enterprise Linux 7 protobuf, protobuf-vim, protobuf-java, protobuf-lite, protobuf-emacs, protobuf-python, +3 more Red Hat Enterprise Linux 8 mecab, mysql, protobuf, mysql-libs, mysql-test, mecab-ipadic, +8 more Red Hat Enterprise Linux 9 mysql, protobuf, mysql-libs, mysql-test, mysql-common, mysql-errmsg, +4 more Red Hat Enterprise Linux 10 mysql8.4, protobuf Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-netty 4.1.124-1.Final_redhat_00001.1.el7eap, eap7-apache-cxf 3.5.11-1.SP1_redhat_00001.1.el7eap, eap7-undertow 2.2.39-1.Final_redhat_00001.1.el7eap, eap7-hibernate 5.3.38-1.Final_redhat_00001.1.el7eap, eap7-resteasy 3.15.11-1.Final_redhat_00001.1.el7eap, eap7-elytron-web 1.9.6-2.Final_redhat_00001.1.el7eap, +73 more Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-netty 4.1.124-1.Final_redhat_00001.1.el8eap, eap7-apache-cxf 3.5.11-1.SP1_redhat_00001.1.el8eap, eap7-undertow 2.2.39-1.Final_redhat_00001.1.el8eap, eap7-hibernate 5.3.38-1.Final_redhat_00001.1.el8eap, eap7-resteasy 3.15.11-1.Final_redhat_00001.1.el8eap, eap7-elytron-web 1.9.6-2.Final_redhat_00001.1.el8eap, +73 more
    +2 more products
    Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-netty 4.1.124-1.Final_redhat_00001.1.el9eap, eap7-apache-cxf 3.5.11-1.SP1_redhat_00001.1.el9eap, eap7-undertow 2.2.39-1.Final_redhat_00001.1.el9eap, eap7-hibernate 5.3.38-1.Final_redhat_00001.1.el9eap, eap7-resteasy 3.15.11-1.Final_redhat_00001.1.el9eap, eap7-elytron-web 1.9.6-2.Final_redhat_00001.1.el9eap, +70 more Red Hat JBoss Enterprise Application Platform 7.4.24 pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1552 more
    not affected: vulnerable code not present
  • Red Hat Single Sign-On 7 protobuf-java
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

2.77% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven com.google.protobuf:protobuf-java
<3.25.5
>=4.0.0-RC1, <4.27.5
>=4.28.0-RC1, <4.28.2
3.25.5
4.27.5
4.28.2
maven com.google.protobuf:protobuf-javalite
<3.25.5
>=4.0.0-RC1, <4.27.5
>=4.28.0-RC1, <4.28.2
3.25.5
4.27.5
4.28.2
maven com.google.protobuf:protobuf-kotlin
<3.25.5
>=4.0.0-RC1, <4.27.5
>=4.28.0-RC1, <4.28.2
3.25.5
4.27.5
4.28.2
maven com.google.protobuf:protobuf-kotlin-lite
<3.25.5
>=4.0.0-RC1, <4.27.5
>=4.28.0-RC1, <4.28.2
3.25.5
4.27.5
4.28.2
rubygems google-protobuf
<3.25.5
>=4.0.0.rc.1, <4.27.5
>=4.28.0.rc.1, <4.28.2
3.25.5
4.27.5
4.28.2

Affected products

  • Google Protocol Buffers
  • Google protobuf-java
  • Google protobuf-javalite
  • Google protobuf-kotlin
  • Google protobuf-kotllin-lite
  • Google google-protobuf [JRuby Gem]
  • google protobuf
  • google protobuf-kotlin-lite

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-674 Uncontrolled Recursion
  • CWE-20 Improper Input Validation
  • CWE-787 Out-of-bounds Write

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.