CVE-2024-7254 Stack overflow in Protocol Buffers Java Lite
Attackers can cause a stack overflow and denial of service by sending deeply nested Protocol Buffers data to applications using the Java Lite parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-7254?
CVE-2024-7254 is a high-severity denial of service vulnerability in Netapp Active Iq Unified Manager, published on 19 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
Which versions are affected by CVE-2024-7254?
30 open source packages ship an affected version, including com.google.protobuf:protobuf-java, com.google.protobuf:protobuf-javalite and com.google.protobuf:protobuf-kotlin. It affects 8 products.
| Package | Affected | Fixed in |
|---|---|---|
com.google.protobuf:protobuf-java Maven | All versions | 3.25.5 |
com.google.protobuf:protobuf-java Maven | All versions | 3.25.5 |
com.google.protobuf:protobuf-java Maven | From 4.0.0-RC1 | 4.27.5 |
com.google.protobuf:protobuf-java Maven | From 4.0.0-RC1 | 4.27.5 |
com.google.protobuf:protobuf-java Maven | From 4.28.0-RC1 | 4.28.2 |
com.google.protobuf:protobuf-java Maven | From 4.28.0-RC1 | 4.28.2 |
24 more packages
com.google.protobuf:protobuf-javalite Maven | All versions | 3.25.5 |
com.google.protobuf:protobuf-javalite Maven | All versions | 3.25.5 |
com.google.protobuf:protobuf-javalite Maven | From 4.0.0-RC1 | 4.27.5 |
com.google.protobuf:protobuf-javalite Maven | From 4.0.0-RC1 | 4.27.5 |
com.google.protobuf:protobuf-javalite Maven | From 4.28.0-RC1 | 4.28.2 |
com.google.protobuf:protobuf-javalite Maven | From 4.28.0-RC1 | 4.28.2 |
com.google.protobuf:protobuf-kotlin Maven | All versions | 3.25.5 |
com.google.protobuf:protobuf-kotlin Maven | All versions | 3.25.5 |
com.google.protobuf:protobuf-kotlin Maven | From 4.0.0-RC1 | 4.27.5 |
com.google.protobuf:protobuf-kotlin Maven | From 4.0.0-RC1 | 4.27.5 |
com.google.protobuf:protobuf-kotlin Maven | From 4.28.0-RC1 | 4.28.2 |
com.google.protobuf:protobuf-kotlin Maven | From 4.28.0-RC1 | 4.28.2 |
com.google.protobuf:protobuf-kotlin-lite Maven | All versions | 3.25.5 |
com.google.protobuf:protobuf-kotlin-lite Maven | All versions | 3.25.5 |
com.google.protobuf:protobuf-kotlin-lite Maven | From 4.0.0-RC1 | 4.27.5 |
com.google.protobuf:protobuf-kotlin-lite Maven | From 4.0.0-RC1 | 4.27.5 |
com.google.protobuf:protobuf-kotlin-lite Maven | From 4.28.0-RC1 | 4.28.2 |
com.google.protobuf:protobuf-kotlin-lite Maven | From 4.28.0-RC1 | 4.28.2 |
google-protobuf RubyGems | All versions | 3.25.5 |
google-protobuf RubyGems | All versions | 3.25.5 |
google-protobuf RubyGems | From 4.0.0.rc.1 | 4.27.5 |
google-protobuf RubyGems | From 4.0.0.rc.1 | 4.27.5 |
google-protobuf RubyGems | From 4.28.0.rc.1 | 4.28.2 |
google-protobuf RubyGems | From 4.28.0.rc.1 | 4.28.2 |
Linux distribution packages (10)
eap7-protostream Red Hat:jboss_enterprise_application_platform_els:7.4::el7 | All versions | 0:4.3.7-1.Final_redhat_00001.1.el7eap |
eap7-wildfly Red Hat:jboss_enterprise_application_platform_els:7.4::el7 | All versions | 0:7.4.23-5.GA_redhat_00004.1.el7eap |
eap7-wildfly-java-jdk11 Red Hat:jboss_enterprise_application_platform_els:7.4::el7 | All versions | 0:7.4.23-5.GA_redhat_00004.1.el7eap |
eap7-wildfly-java-jdk8 Red Hat:jboss_enterprise_application_platform_els:7.4::el7 | All versions | 0:7.4.23-5.GA_redhat_00004.1.el7eap |
eap7-wildfly-javadocs Red Hat:jboss_enterprise_application_platform_els:7.4::el7 | All versions | 0:7.4.23-5.GA_redhat_00004.1.el7eap |
eap7-wildfly-modules Red Hat:jboss_enterprise_application_platform_els:7.4::el7 | All versions | 0:7.4.23-5.GA_redhat_00004.1.el7eap |
eap7-protostream Red Hat:jboss_enterprise_application_platform_els:7.4::el8 | All versions | 0:4.3.7-1.Final_redhat_00001.1.el8eap |
eap7-wildfly Red Hat:jboss_enterprise_application_platform_els:7.4::el8 | All versions | 0:7.4.23-5.GA_redhat_00004.1.el8eap |
eap7-wildfly-java-jdk11 Red Hat:jboss_enterprise_application_platform_els:7.4::el8 | All versions | 0:7.4.23-5.GA_redhat_00004.1.el8eap |
eap7-wildfly-java-jdk17 Red Hat:jboss_enterprise_application_platform_els:7.4::el8 | All versions | 0:7.4.23-5.GA_redhat_00004.1.el8eap |
Products include Google Protobuf, Google Protobuf-Java, Google Protobuf-Javalite, Google Protobuf-Kotlin, Google Protobuf-Kotlin-Lite, Netapp Active Iq Unified Manager and 2 more.
How do I fix CVE-2024-7254?
Upgrade com.google.protobuf:protobuf-java to a fixed version for your release line: 3.25.5, 4.27.5 or 4.28.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-7254 being exploited?
There is no known exploitation of CVE-2024-7254 in the wild and no public exploit code.
Other vulnerabilities in Netapp Active Iq Unified Manager
Sources
Also known as BELL-CVE-2024-7254, CLEANSTART-2026-BS99432, CLEANSTART-2026-HX93529, CLSA-2025-1757017511, CLSA-2026-1774398095, CLSA-2026-1779410884 and 34 more.