CVE-2023-24535: Panic when parsing invalid messages in google.golang.org/protobuf
Parsing invalid messages can panic.
Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-24535?
CVE-2023-24535 is classified as a moderate severity vulnerability due to its potential to cause a panic in the application.
How do I fix CVE-2023-24535?
To fix CVE-2023-24535, upgrade to version 1.29.1 of the google.golang.org/protobuf package or ensure you are not using version 1.29.0.
What causes the panic in CVE-2023-24535?
The panic in CVE-2023-24535 is caused by parsing a text-format message that contains a minus sign followed by whitespace and no further input.
Which versions of the protobuf package are affected by CVE-2023-24535?
CVE-2023-24535 affects versions 1.29.0 and earlier of the google.golang.org/protobuf package.
Is CVE-2023-24535 exploitative?
CVE-2023-24535 can lead to application crashes when invalid messages are processed, making it a concern for stability but not directly exploitative.