Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-24535: Go protobuf packages can crash on malformed text messages

CVE-2023-24535 · published 3 years ago

Summary

The Go protobuf libraries (google.golang.org/protobuf and related Go protobuf packages) may stop working and cause the program to crash if they try to read a text‑format message that has a minus sign followed by whitespace but no number. This can disrupt services that rely on these libraries to decode protobuf data. Update to the latest version of the affected packages, which includes a fix that prevents the crash.

What to do

Update google.golang.org protobuf to version 1.29.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
go	google.golang.org	protobuf	>= 1.29.0, < 1.29.1 Fix: upgrade to 1.29.1
–	protobuf	protobuf	1.29.0 `cpe:2.3:a:protobuf:protobuf:1.29.0:::::go::`
Ubuntu:16.04:LTS	canonical	golang-goprotobuf	All versions
Ubuntu:24.04:LTS	canonical	golang-github-golang-protobuf-1-3	All versions
Ubuntu:24.04:LTS	canonical	golang-github-golang-protobuf-1-5	All versions

Original advisory text

Panic when parsing invalid messages in google.golang.org/protobuf

Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.

References

https://github.com/advisories/GHSA-hw7c-3rfg-p46j
https://nvd.nist.gov/vuln/detail/CVE-2023-24535 Vendor Advisory
https://pkg.go.dev/vuln/GO-2023-1631 Third Party Advisory
https://github.com/golang/protobuf/issues/1530 Third Party Advisory
https://ubuntu.com/security/CVE-2023-24535 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-24535 Third Party Advisory
https://go.dev/cl/475995 Third Party Advisory
https://pkg.go.dev URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24535... Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published8 Jun 2023

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-hw7c-3rfg-p46j · GHSA

CVE-2023-24535 · NVD

UBUNTU-CVE-2023-24535 · OSV

CVE-2023-24535 · OSV

Track software like this

Free during beta