CVE-2023-24535

Published: Jun 8, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.

Affected (1)

Products: Protobuf: Protobuf

Protobuf

1 product

Protobuf

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Protobuf Protobuf	Version 1.29.0

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (6)

https://github.com/golang/protobuf/issues/1530

Source: security@golang.org

Issue Tracking

https://go.dev/cl/475995

Source: security@golang.org

Patch

https://pkg.go.dev/vuln/GO-2023-1631

Source: security@golang.org

Third Party Advisory

https://github.com/golang/protobuf/issues/1530

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://go.dev/cl/475995

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://pkg.go.dev/vuln/GO-2023-1631

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.