CVE-2024-24786

What it actually does

protojson.Unmarshal enters an infinite loop on specific invalid JSON when targeting google.protobuf.Any fields or when UnmarshalOptions.DiscardUnknown is enabled, consuming CPU and blocking the goroutine.

Why it matters to the business

Services that accept untrusted JSON can be rendered unresponsive, causing outages, delayed processing, and increased operational load until the affected process is restarted.

How an attack unfolds

An attacker identifies an HTTP or gRPC endpoint that uses protojson.Unmarshal on attacker-controlled JSON, crafts a minimal invalid payload that triggers the Any or DiscardUnknown code path, and repeatedly sends the payload to exhaust worker threads or CPU capacity.

How to fix it

Upgrade the golang.org/x/protobuf and google.golang.org/protobuf modules to versions containing the corrected Unmarshal implementation; rebuild and redeploy all affected binaries.

How to confirm the fix worked

Execute unit tests that feed the previously triggering JSON payloads into protojson.Unmarshal under both Any and DiscardUnknown configurations and confirm termination within expected time bounds; scan go.mod files for updated module versions.

Typical attack path

1. Locate service entry points that invoke protojson.Unmarshal on JSON input
2. Generate invalid JSON that exercises google.protobuf.Any or DiscardUnknown paths
3. Transmit the payload via network request or message queue
4. Observe sustained high CPU or goroutine blockage confirming the loop

How to detect it

Search application and system logs for repeated entries showing JSON unmarshal calls with no completion, correlate with process CPU or goroutine profiles showing blocked threads in protojson code paths.

What your security team should do

• Inventory all Go services importing protojson and schedule upgrades
• Add request timeouts and resource limits around unmarshal calls pending the patch
• Monitor for sustained high CPU on services handling JSON/protobuf traffic