CVE-2024-7254

HIGH

Google Protobuf < 3.25.5 - Uncontrolled Recursion via Nested Groups

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-7254. PoCs published by Ayumu3746221.

AI-analyzed exploit summary Detailed technical analysis of CVE-2024-7254, a Stack Overflow DoS vulnerability in protobuf-java (versions <3.25.5, <4.27.5, <4.28.2) caused by uncontrolled recursion in GROUP wire type parsing. The writeup includes root cause analysis, patch diffs, reproduction steps, and Docker-based experimental setup for academic research.

Description

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

Exploits (1)

github WRITEUP
by Ayumu3746221 · poc
https://github.com/Ayumu3746221/cve-2024-7254-app-lab

Detailed technical analysis of CVE-2024-7254, a Stack Overflow DoS vulnerability in protobuf-java (versions <3.25.5, <4.27.5, <4.28.2) caused by uncontrolled recursion in GROUP wire type parsing. The writeup includes root cause analysis, patch diffs, reproduction steps, and Docker-based experimental setup for academic research.

Classification
Writeup 98%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: protobuf-java (versions <3.25.5, <4.27.5, <4.28.2), protobuf-javalite, protobuf-kotlin, protobuf-kotlin-lite
No auth needed
Prerequisites: Target must use vulnerable protobuf-java version · Attacker must send crafted Protobuf message with deep GROUP wire type nesting · Target must parse the message (e.g., via gRPC or direct Protobuf parsing)
mistral-large-3 · analyzed Jul 08, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 7.5
EPSS 0.0277
EPSS Percentile 84.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-400 CWE-674 CWE-787
Status published
Products (13)
com.google.protobuf/protobuf-java 0 - 3.25.5Maven
com.google.protobuf/protobuf-javalite 0 - 3.25.5Maven
com.google.protobuf/protobuf-kotlin 0 - 3.25.5Maven
com.google.protobuf/protobuf-kotlin-lite 0 - 3.25.5Maven
google/protobuf < 3.25.5
google/protobuf-java < 3.25.5
google/protobuf-javalite < 3.25.5
google/protobuf-kotlin < 3.25.5
google/protobuf-kotlin-lite < 3.25.5
netapp/active_iq_unified_manager (3 CPE variants)
... and 3 more
Published Sep 19, 2024
Tracked Since Feb 18, 2026