CVE-2024-7254: Google Protobuf DOS Vulnerability

CVE-2024-7254 Overview

CVE-2024-7254 is a stack overflow vulnerability affecting Google Protocol Buffers (protobuf) that enables denial of service attacks through unbounded recursion. Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups or series of SGROUP tags can be corrupted by exceeding the stack limit, resulting in a StackOverflow condition. The vulnerability is triggered when parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creating unbounded recursions that can be abused by an attacker.

Critical Impact

Attackers can craft malicious Protocol Buffers messages with deeply nested SGROUP tags to crash applications by exhausting the stack, causing denial of service across any system parsing untrusted protobuf data.

Affected Products

• Google Protobuf (Ruby bindings)
• Google protobuf-java
• Google protobuf-javalite
• Google protobuf-kotlin
• Google protobuf-kotlin-lite
• NetApp Active IQ Unified Manager (Linux, VMware vSphere, Windows)
• NetApp BlueXP
• NetApp ONTAP Tools 10 for VMware vSphere

Discovery Timeline

• 2024-09-19 - CVE-2024-7254 published to NVD
• 2025-09-26 - Last updated in NVD database

Technical Details for CVE-2024-7254

Vulnerability Analysis

This vulnerability represents a resource exhaustion condition (CWE-400) combined with out-of-bounds write potential (CWE-787) in Google Protocol Buffers parsing logic. The flaw exists in how protobuf parsers handle nested group structures within serialized messages. Protocol Buffers use SGROUP and EGROUP wire type markers to delimit groups, and when an attacker crafts a message with arbitrarily deep nesting of these group structures, the parser follows the recursion without adequate depth checking.

The vulnerability is particularly dangerous because it affects multiple language bindings and parsing modes. The Java implementation's DiscardUnknownFieldsParser, the Protobuf Lite parser variant, and map field parsing are all vulnerable code paths. When processing unknown fields or map structures, the parser recursively descends into nested groups, and with sufficient nesting depth, the call stack is exhausted before parsing completes.

Root Cause

The root cause is insufficient recursion depth limiting in the Protocol Buffers parsing implementation. When encountering nested group wire types during deserialization, the parser uses recursive function calls to process each nesting level. Without enforcing a maximum recursion depth, an attacker can supply input that exceeds the available stack space, causing the application to crash with a StackOverflowError (in Java) or equivalent stack exhaustion on other platforms.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending a maliciously crafted Protocol Buffers message to any application that deserializes untrusted protobuf data. The attack message contains deeply nested SGROUP tags that trigger unbounded recursion during parsing. Since Protocol Buffers is commonly used in gRPC services, microservices communication, and data serialization across networked systems, the attack surface is substantial for applications accepting external input.

The following code shows part of the official security patch that addresses the vulnerability:

   static InvalidProtocolBufferException recursionLimitExceeded() {
     return new InvalidProtocolBufferException(
         "Protocol message had too many levels of nesting.  May be malicious.  "
-            + "Use CodedInputStream.setRecursionLimit() to increase the depth limit.");
+            + "Use setRecursionLimit() to increase the recursion depth limit.");
   }

Source: GitHub Commit Update

Detection Methods for CVE-2024-7254

Indicators of Compromise

• Application crashes with StackOverflowError or stack exhaustion conditions during protobuf deserialization
• Sudden memory spikes followed by process termination in services handling Protocol Buffers data
• Repeated service restarts or health check failures in gRPC or protobuf-based microservices
• Log entries indicating deep recursion or malformed protobuf messages

Detection Strategies

• Monitor application logs for StackOverflowError exceptions or recursion-related error messages in Java applications
• Implement application performance monitoring (APM) to detect abnormal stack depth or memory consumption patterns
• Deploy network-level inspection to identify Protocol Buffers messages with unusual nesting characteristics
• Use SentinelOne Singularity to detect process crashes and abnormal application behavior indicative of DoS attacks

Monitoring Recommendations

• Enable verbose logging for protobuf parsing operations to capture malformed input patterns
• Set up alerts for repeated process crashes or restarts in services that process untrusted Protocol Buffers data
• Monitor CPU and memory utilization for anomalies that may indicate resource exhaustion attacks
• Track error rates and latency in gRPC services for early warning signs of exploitation attempts

How to Mitigate CVE-2024-7254

Immediate Actions Required

• Update Google Protocol Buffers libraries to patched versions immediately across all affected applications
• Audit applications to identify all instances where untrusted Protocol Buffers data is parsed
• Implement input validation to reject Protocol Buffers messages from untrusted sources with excessive nesting depth
• Configure explicit recursion limits using setRecursionLimit() on CodedInputStream instances as an additional safeguard

Patch Information

Google has released a security patch addressing this vulnerability. The fix is available in commit cc8b3483a5584b3301e3d43d17eb59704857ffaa in the protobuf GitHub repository. Organizations using NetApp products should consult the NetApp Security Advisory #20241213-0010 and NetApp Security Advisory #20250418-0006 for vendor-specific patching guidance.

Workarounds

• Set explicit recursion limits on all protobuf parser instances using CodedInputStream.setRecursionLimit() with conservative values
• Implement message size limits to reduce the potential for deeply nested malicious payloads
• Deploy network-level filtering to inspect and reject abnormally structured Protocol Buffers messages at ingress points
• Consider wrapping protobuf parsing in isolated processes or containers to limit the blast radius of stack exhaustion

# Example: Check protobuf-java version in Maven projects
mvn dependency:tree | grep -i protobuf

# Example: Update protobuf dependency in pom.xml to patched version
# Ensure all protobuf-java, protobuf-javalite, and protobuf-kotlin dependencies are updated