cloudflare / cloudflare/pingora
RUSTSEC-2024-0437: Crash due to uncontrolled recursion in protobuf crate
- Dominant language
- Rust
- Stars
- 27.4k
- Forks
- 1.7k
- Avg merge
- 6h 22m
- Merged PRs (30d)
- 3
Description
> Crash due to uncontrolled recursion in protobuf crate
| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `protobuf` |
| Version | `2.28.0` |
| URL | [https://github.com/stepancheg/rust-protobuf/issues/749](https://github.com/stepancheg/rust-protobuf/issues/749) |
| Date | 2024-12-12 |
Affected version of this crate did not properly parse unknown fields when parsing a user-supplied input.
This allows an attacker to cause a stack overflow when parsing the mssage on untrusted data.
See [advisory page](https://rustsec.org/advisories/RUSTSEC-2024-0437.html) for additional details.
Contributor guide
Assessment
This issue has not been assessed yet.