Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON

2024-03-0600:31:27

CWE-835

GitHub Advisory Database

github.com

golang

protojson

unmarshal

infinite loop

invalid json

unmarshaloptions

discardunknown

software

AI Score

6.7

Confidence

Low

EPSS

Percentile

15.5%

JSON

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

Affected configurations

Vulners

Node

encodingjsonRange<1.33.0

encodingprotojsonRange<1.33.0

google.golang.orgprotobufRange<1.33.0

VendorProductVersionCPE
encodingjson*cpe:2.3:a:encoding:json:*:*:*:*:*:*:*:*
encodingprotojson*cpe:2.3:a:encoding:protojson:*:*:*:*:*:*:*:*
google.golang.orgprotobuf*cpe:2.3:a:google.golang.org:protobuf:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
encoding	json	*	cpe:2.3:a:encoding:json::::::::
encoding	protojson	*	cpe:2.3:a:encoding:protojson::::::::
google.golang.org	protobuf	*	cpe:2.3:a:google.golang.org:protobuf::::::::