CVE-2023-24535
golang/Protobuf: panic when parsing an incomplete number
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · June 14, 2023
Updated · September 17, 2026
Description
A flaw was found in the golang implementation of the protobuf protocol. This issue occurs when parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input, which will cause a panic.
Statement
Red Hat does not include the affected version (v1.29.0) in any of its software.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-400 · Uncontrolled Resource Consumption