Описание
google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.
A flaw was found in google-protobuf. An unauthenticated remote attacker can send a specially crafted message containing deeply nested protobuf group fields to a Node.js service using the affected library. This uncontrolled recursion can cause the service to crash, leading to a Denial of Service (DoS) for legitimate users.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-core-bff-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-dashboard-operator-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-dashboard-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-agent-ops-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-automl-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-autorag-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-eval-hub-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-gen-ai-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-maas-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-mlflow-rhel9 | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.
EPSS
7.5 High
CVSS3