Read the docs
TI-2024-06719 Aliases CVE-2024-7254GHSA-735f-pc8j-v9w8

Stack overflow in Protocol Buffers Java Lite

Priority MEDIUM 49CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 11 fixed, 13 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02772 86th percentileScored 2026-11-07
Fix Partial Protocol Buffers (Google): 28.2protobuf-java (Google): 3.25.5, 4.27.5, 4.28.2+9 more productsRed Hat: 14 advisoriesRed Hat: 11 fixed, 13 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleProtocol Buffersbefore 28.228.2Patch availableCNA
Googleprotobuf-javabefore 3.25.5; before 4.27.5; before 4.28.23.25.5, 4.27.5, 4.28.2Patch availableCNA
Googleprotobuf-javalitebefore 3.25.5; before 4.27.5; before 4.28.23.25.5, 4.27.5, 4.28.2Patch availableCNA
Googleprotobuf-kotlinbefore 3.25.5; before 4.27.5; before 4.28.23.25.5, 4.27.5, 4.28.2Patch availableCNA
Googleprotobuf-kotllin-litebefore 3.25.5; before 4.27.5; before 4.28.23.25.5, 4.27.5, 4.28.2Patch availableCNA
Googlegoogle-protobuf [JRuby Gem]before 3.25.5; before 4.27.5; before 4.28.23.25.5, 4.27.5, 4.28.2Patch availableCNA
—com.google.protobuf:protobuf-java (Maven)before 3.25.53.25.5Patch availableGHSA-735f-pc8j-v9w8
—com.google.protobuf:protobuf-javalite (Maven)before 3.25.53.25.5Patch availableGHSA-735f-pc8j-v9w8
—com.google.protobuf:protobuf-kotlin (Maven)before 3.25.53.25.5Patch availableGHSA-735f-pc8j-v9w8
—com.google.protobuf:protobuf-kotlin-lite (Maven)before 3.25.53.25.5Patch availableGHSA-735f-pc8j-v9w8
—google-protobuf (RubyGems)before 3.25.53.25.5Patch availableGHSA-735f-pc8j-v9w8
—google-protobuf (RubyGems)4.0.0.rc.1 to before 4.27.54.27.5Patch availableGHSA-735f-pc8j-v9w8
—google-protobuf (RubyGems)4.28.0.rc.1 to before 4.28.24.28.2Patch availableGHSA-735f-pc8j-v9w8
—com.google.protobuf:protobuf-kotlin-lite (Maven)4.0.0-RC1 to before 4.27.54.27.5Patch availableGHSA-735f-pc8j-v9w8
—com.google.protobuf:protobuf-kotlin-lite (Maven)4.28.0-RC1 to before 4.28.24.28.2Patch availableGHSA-735f-pc8j-v9w8
—com.google.protobuf:protobuf-kotlin (Maven)4.0.0-RC1 to before 4.27.54.27.5Patch availableGHSA-735f-pc8j-v9w8
—com.google.protobuf:protobuf-kotlin (Maven)4.28.0-RC1 to before 4.28.24.28.2Patch availableGHSA-735f-pc8j-v9w8
—com.google.protobuf:protobuf-javalite (Maven)4.0.0-RC1 to before 4.27.54.27.5Patch availableGHSA-735f-pc8j-v9w8
—com.google.protobuf:protobuf-javalite (Maven)4.28.0-RC1 to before 4.28.24.28.2Patch availableGHSA-735f-pc8j-v9w8
—com.google.protobuf:protobuf-java (Maven)4.0.0-RC1 to before 4.27.54.27.5Patch availableGHSA-735f-pc8j-v9w8
—com.google.protobuf:protobuf-java (Maven)4.28.0-RC1 to before 4.28.24.28.2Patch availableGHSA-735f-pc8j-v9w8
  • Protocol Buffers VendorGoogle Affected before 28.2 Fixed in 28.2 Patch available CNA
  • protobuf-java VendorGoogle Affected before 3.25.5; before 4.27.5; before 4.28.2 Fixed in 3.25.5, 4.27.5, 4.28.2 Patch available CNA
  • protobuf-javalite VendorGoogle Affected before 3.25.5; before 4.27.5; before 4.28.2 Fixed in 3.25.5, 4.27.5, 4.28.2 Patch available CNA
  • protobuf-kotlin VendorGoogle Affected before 3.25.5; before 4.27.5; before 4.28.2 Fixed in 3.25.5, 4.27.5, 4.28.2 Patch available CNA
  • protobuf-kotllin-lite VendorGoogle Affected before 3.25.5; before 4.27.5; before 4.28.2 Fixed in 3.25.5, 4.27.5, 4.28.2 Patch available CNA
  • google-protobuf [JRuby Gem] VendorGoogle Affected before 3.25.5; before 4.27.5; before 4.28.2 Fixed in 3.25.5, 4.27.5, 4.28.2 Patch available CNA
  • com.google.protobuf:protobuf-java (Maven) Vendor— Affected before 3.25.5 Fixed in 3.25.5 Patch available GHSA-735f-pc8j-v9w8
  • com.google.protobuf:protobuf-javalite (Maven) Vendor— Affected before 3.25.5 Fixed in 3.25.5 Patch available GHSA-735f-pc8j-v9w8
  • com.google.protobuf:protobuf-kotlin (Maven) Vendor— Affected before 3.25.5 Fixed in 3.25.5 Patch available GHSA-735f-pc8j-v9w8
  • com.google.protobuf:protobuf-kotlin-lite (Maven) Vendor— Affected before 3.25.5 Fixed in 3.25.5 Patch available GHSA-735f-pc8j-v9w8
  • google-protobuf (RubyGems) Vendor— Affected before 3.25.5 Fixed in 3.25.5 Patch available GHSA-735f-pc8j-v9w8
  • google-protobuf (RubyGems) Vendor— Affected 4.0.0.rc.1 to before 4.27.5 Fixed in 4.27.5 Patch available GHSA-735f-pc8j-v9w8
  • google-protobuf (RubyGems) Vendor— Affected 4.28.0.rc.1 to before 4.28.2 Fixed in 4.28.2 Patch available GHSA-735f-pc8j-v9w8
  • com.google.protobuf:protobuf-kotlin-lite (Maven) Vendor— Affected 4.0.0-RC1 to before 4.27.5 Fixed in 4.27.5 Patch available GHSA-735f-pc8j-v9w8
  • com.google.protobuf:protobuf-kotlin-lite (Maven) Vendor— Affected 4.28.0-RC1 to before 4.28.2 Fixed in 4.28.2 Patch available GHSA-735f-pc8j-v9w8
  • com.google.protobuf:protobuf-kotlin (Maven) Vendor— Affected 4.0.0-RC1 to before 4.27.5 Fixed in 4.27.5 Patch available GHSA-735f-pc8j-v9w8
  • com.google.protobuf:protobuf-kotlin (Maven) Vendor— Affected 4.28.0-RC1 to before 4.28.2 Fixed in 4.28.2 Patch available GHSA-735f-pc8j-v9w8
  • com.google.protobuf:protobuf-javalite (Maven) Vendor— Affected 4.0.0-RC1 to before 4.27.5 Fixed in 4.27.5 Patch available GHSA-735f-pc8j-v9w8
  • com.google.protobuf:protobuf-javalite (Maven) Vendor— Affected 4.28.0-RC1 to before 4.28.2 Fixed in 4.28.2 Patch available GHSA-735f-pc8j-v9w8
  • com.google.protobuf:protobuf-java (Maven) Vendor— Affected 4.0.0-RC1 to before 4.27.5 Fixed in 4.27.5 Patch available GHSA-735f-pc8j-v9w8
  • com.google.protobuf:protobuf-java (Maven) Vendor— Affected 4.28.0-RC1 to before 4.28.2 Fixed in 4.28.2 Patch available GHSA-735f-pc8j-v9w8

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:google:protobuf:*:*:*:*:*:ruby:*:*before 3.25.5; 4.0.0 to before 4.27.5; 4.28.0 to before 4.28.2VulnerableGoogle
cpe:2.3:a:google:protobuf-java:*:*:*:*:*:*:*:*before 3.25.5; 4.0.0 to before 4.27.5; 4.28.0 to before 4.28.2VulnerableGoogle
cpe:2.3:a:google:protobuf-javalite:*:*:*:*:*:*:*:*before 3.25.5; 4.0.0 to before 4.27.5; 4.28.0 to before 4.28.2VulnerableGoogle
cpe:2.3:a:google:protobuf-kotlin:*:*:*:*:*:*:*:*before 3.25.5; 4.0.0 to before 4.27.5; 4.28.0 to before 4.28.2VulnerableGoogle
cpe:2.3:a:google:protobuf-kotlin-lite:*:*:*:*:*:*:*:*before 3.25.5; 4.0.0 to before 4.27.5; 4.28.0 – 4.28.2VulnerableGoogle
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*10VulnerableNetApp
  • cpe:2.3:a:google:protobuf:*:*:*:*:*:ruby:*:* Versions before 3.25.5; 4.0.0 to before 4.27.5; 4.28.0 to before 4.28.2 Vulnerable ·Google
  • cpe:2.3:a:google:protobuf-java:*:*:*:*:*:*:*:* Versions before 3.25.5; 4.0.0 to before 4.27.5; 4.28.0 to before 4.28.2 Vulnerable ·Google
  • cpe:2.3:a:google:protobuf-javalite:*:*:*:*:*:*:*:* Versions before 3.25.5; 4.0.0 to before 4.27.5; 4.28.0 to before 4.28.2 Vulnerable ·Google
  • cpe:2.3:a:google:protobuf-kotlin:*:*:*:*:*:*:*:* Versions before 3.25.5; 4.0.0 to before 4.27.5; 4.28.0 to before 4.28.2 Vulnerable ·Google
  • cpe:2.3:a:google:protobuf-kotlin-lite:*:*:*:*:*:*:*:* Versions before 3.25.5; 4.0.0 to before 4.27.5; 4.28.0 – 4.28.2 Vulnerable ·Google
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:* Versions 10 Vulnerable ·NetApp

Remediation

  • Fix · CNA Protocol Buffers (Google) Fixed in 28.2
  • Fix · CNA protobuf-java (Google) Fixed in 3.25.5, 4.27.5, 4.28.2
  • Fix · CNA protobuf-javalite (Google) Fixed in 3.25.5, 4.27.5, 4.28.2
  • Fix · CNA protobuf-kotlin (Google) Fixed in 3.25.5, 4.27.5, 4.28.2
  • Fix · CNA protobuf-kotllin-lite (Google) Fixed in 3.25.5, 4.27.5, 4.28.2
  • Fix · CNA google-protobuf [JRuby Gem] (Google) Fixed in 3.25.5, 4.27.5, 4.28.2
  • Fix · GHSA-735f-pc8j-v9w8 com.google.protobuf:protobuf-java (Maven) Fixed in 3.25.5 Advisory →
  • Fix · GHSA-735f-pc8j-v9w8 com.google.protobuf:protobuf-javalite (Maven) Fixed in 3.25.5 Advisory →
  • Fix · GHSA-735f-pc8j-v9w8 com.google.protobuf:protobuf-kotlin (Maven) Fixed in 3.25.5 Advisory →
  • Fix · GHSA-735f-pc8j-v9w8 com.google.protobuf:protobuf-kotlin-lite (Maven) Fixed in 3.25.5 Advisory →
  • Fix · GHSA-735f-pc8j-v9w8 google-protobuf (RubyGems) Fixed in 3.25.5 Advisory →
  • Fix · GHSA-735f-pc8j-v9w8 google-protobuf (RubyGems) Fixed in 4.27.5 Advisory →
  • Fix · GHSA-735f-pc8j-v9w8 google-protobuf (RubyGems) Fixed in 4.28.2 Advisory →
  • Fix · GHSA-735f-pc8j-v9w8 com.google.protobuf:protobuf-kotlin-lite (Maven) Fixed in 4.27.5 Advisory →
  • Fix · GHSA-735f-pc8j-v9w8 com.google.protobuf:protobuf-kotlin-lite (Maven) Fixed in 4.28.2 Advisory →
  • Fix · GHSA-735f-pc8j-v9w8 com.google.protobuf:protobuf-kotlin (Maven) Fixed in 4.27.5 Advisory →
  • Fix · GHSA-735f-pc8j-v9w8 com.google.protobuf:protobuf-kotlin (Maven) Fixed in 4.28.2 Advisory →
  • Fix · GHSA-735f-pc8j-v9w8 com.google.protobuf:protobuf-javalite (Maven) Fixed in 4.27.5 Advisory →
  • Fix · GHSA-735f-pc8j-v9w8 com.google.protobuf:protobuf-javalite (Maven) Fixed in 4.28.2 Advisory →
  • Fix · GHSA-735f-pc8j-v9w8 com.google.protobuf:protobuf-java (Maven) Fixed in 4.27.5 Advisory →
  • Fix · GHSA-735f-pc8j-v9w8 com.google.protobuf:protobuf-java (Maven) Fixed in 4.28.2 Advisory →

Red Hat 14 advisories

  • RHSA-2026:4917 Released 2026-03-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.24 security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el9eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el9eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el9eap +40
  • RHSA-2026:4915 Released 2026-03-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.24 security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el7eap +42
  • RHSA-2026:4916 Released 2026-03-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.24 security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el8eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el8eap +43
Show 11 more Red Hat advisories
  • RHSA-2025:20057 Released 2025-11-10 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.23 security update
    • Red Hat JBoss Enterprise Application Platform 7.4.24 org.infinispan.protostream.protostream-4.3.7.Final-redhat-00001.jar
  • RHSA-2025:20052 Released 2025-11-10 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.23 security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-protostream-4.3.7-1.Final_redhat_00001.1.el7eap, eap7-wildfly-7.4.23-5.GA_redhat_00004.1.el7eap, eap7-wildfly-java-jdk11-7.4.23-5.GA_redhat_00004.1.el7eap +3
    • Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-protostream-4.3.7-1.Final_redhat_00001.1.el8eap, eap7-wildfly-7.4.23-5.GA_redhat_00004.1.el8eap, eap7-wildfly-java-jdk11-7.4.23-5.GA_redhat_00004.1.el8eap +4
    • Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-protostream-4.3.7-1.Final_redhat_00001.1.el9eap, eap7-wildfly-7.4.23-5.GA_redhat_00004.1.el9eap, eap7-wildfly-java-jdk11-7.4.23-5.GA_redhat_00004.1.el9eap +4
  • RHSA-2025:7620 Released 2025-05-14 · Red Hat rating Important
    JBoss EAP XP 5.0 Update 2.0 release. See references for release notes.
    • Red Hat JBoss EAP XP 5.0 Update 2.0
  • RHSA-2024:11256 Released 2024-12-17 · Red Hat rating Important
    Red Hat Trusted Profile Analyzer 1.2.1
    • Red Hat Trusted Profile Analyzer 1.2 registry.redhat.io/rhtpa/rhtpa-guac-rhel9
  • RHSA-2024:11255 Released 2024-12-17 · Red Hat rating Important
    Red Hat Trusted Profile Analyzer 1.2.1
    • Red Hat Trusted Profile Analyzer 1.2 registry.redhat.io/rhtpa/rhtpa-trustification-service-rhel9
  • RHSA-2024:10700 Released 2024-12-02 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.8 for Spring Boot security update.
    • Red Hat build of Apache Camel 4.8 for Spring Boot
  • RHSA-2024:9571 Released 2024-11-13 · Red Hat rating Moderate
    Streams for Apache Kafka 2.8.0 release and security update
    • Streams for Apache Kafka 2.8.0
  • RHSA-2024:8064 Released 2024-10-14 · Red Hat rating Critical
    Red Hat Build of Apache Camel 4.4.3 for Spring Boot security update.
    • Red Hat build of Apache Camel 4.4.3 for Spring Boot
  • RHSA-2024:7972 Released 2024-10-10 · Red Hat rating Critical
    Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.SP1)
    • Red Hat build of Apache Camel 4 for Quarkus 3
  • RHSA-2024:7676 Released 2024-10-10 · Red Hat rating Critical
    Red Hat build of Quarkus 3.2.12.SP1 Security Update
    • Red Hat build of Quarkus Native builder
  • RHSA-2024:7670 Released 2024-10-10 · Red Hat rating Critical
    Red Hat build of Quarkus 3.8.6.SP1 Security Update
    • Red Hat build of Quarkus Native builder

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix planned: Will not fix
Red Hat Data Grid 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AI (RHEL AI)AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Red Hat build of Debezium 2AffectedNo fix planned: Will not fix
streams for Apache KafkaAffectedNo fix yet
Red Hat JBoss EAP 7.4 ELS for RHEL 7 ServerFixed RHSA-2025:20052, RHSA-2026:4915
Red Hat JBoss EAP 7.4 ELS for RHEL 8Fixed RHSA-2025:20052, RHSA-2026:4916
Red Hat JBoss EAP 7.4 ELS for RHEL 9Fixed RHSA-2025:20052, RHSA-2026:4917
Red Hat JBoss EAP XP 5.0 Update 2.0Fixed RHSA-2025:7620
Red Hat JBoss Enterprise Application Platform 7.4.24Fixed RHSA-2025:20057
Red Hat Trusted Profile Analyzer 1.2Fixed RHSA-2024:11255, RHSA-2024:11256
Red Hat build of Apache Camel 4 for Quarkus 3Fixed RHSA-2024:7972
Red Hat build of Apache Camel 4.4.3 for Spring BootFixed RHSA-2024:8064
Red Hat build of Apache Camel 4.8 for Spring BootFixed RHSA-2024:10700
Red Hat build of Quarkus Native builderFixed RHSA-2024:7676
Streams for Apache Kafka 2.8.0Fixed RHSA-2024:9571
Not affected: 10 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 ELS for RHEL 8
  • Red Hat JBoss EAP 7.4 ELS for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 7.4.24
  • Red Hat Single Sign-On 7
  • Red Hat build of OptaPlanner 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7254
  2. 2026-10-03 Alias added: GHSA-735f-pc8j-v9w8
  3. 2026-10-20 Fix available: Red Hat build of Quarkus Native builder · Red Hat

References

Patch 1

Advisory 3

Other 10

  • TI-2015-04398 protobuf allows remote authenticated attackers to cause a heap-based buffer overflow. CVSS 3.1HIGH 8.8
  • TI-2026-00748 Denial of Service in Python Protobuf CVSS 4.0HIGH 8.2
  • TI-2024-02238 Use after free in C++ protobuf CVSS 3.1CRITICAL 9.8
  • TI-2021-05524 Nullptr Dereference in Protobuf CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences