| Package | Affected versions | Patched versions |
|---|---|---|
| google.golang.org/protobuf | < 1.33.0 | 1.33.0 |
| google.golang.org/protobuf/encoding/protojson | < 1.33.0 | 1.33.0 |
| google.golang.org/protobuf/internal/encoding/json | < 1.33.0 | 1.33.0 |
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free