CVE-2024-7254

Name	CVE-2024-7254
Description	Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1082381

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
protobuf (PTS)	bullseye	3.12.4-1+deb11u1	vulnerable
	bookworm	3.21.12-3	vulnerable
	sid, trixie	3.21.12-10	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
protobuf	source	(unstable)	(unfixed)			1082381

Notes

[bookworm] - protobuf <no-dsa> (Minor issue)
[bullseye] - protobuf <postponed> (Minor issue)
https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa