High USN-7435-1 1 CVE

protobuf vulnerability

Published Apr 14, 2025 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Protocol Buffers incorrectly handled memory when
receiving malicious input using the Java bindings. An attacker could
possibly use this issue to cause a denial of service.

Fixed packages 2

Release	Package	Fixed in
Ubuntu · 22.04 LTS 22.04:LTS	protobuf	3.12.4-1ubuntu7.22.04.2
Ubuntu · 24.04 LTS 24.04:LTS	protobuf	3.21.12-8.2ubuntu0.1

Vulnerabilities 1

High 8.7

CVE-2024-7254

Stack overflow in Protocol Buffers Java Lite

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsPar…

Google protobuf-kotlin protobuf-java google-protobuf [JRuby Gem] Debian Ubuntu Wolfi Maven RubyGems

Sep 19, 2024

References

report
https://ubuntu.com/security/CVE-2024-7254