CVE-2023-24535

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
google.golang.org/protobuf	google.golang.org/protobuf/encoding/prototext	>= 1.29.0, < 1.29.1
google.golang.org/protobuf	google.golang.org/protobuf/internal/encoding/text	>= 1.29.0, < 1.29.1

References

https://github.com/golang/protobuf/issues/1530Issue Tracking
https://go.dev/cl/475995Patch
https://pkg.go.dev/vuln/GO-2023-1631Third Party Advisory
https://github.com/golang/protobuf/issues/1530Issue Tracking
https://go.dev/cl/475995Patch
https://pkg.go.dev/vuln/GO-2023-1631Third Party Advisory

Timeline

Published: Jun 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-245367.5Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This CVE-2023-245377.5Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loo CVE-2023-245389.8Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, si CVE-2023-245397.3Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated CVE-2023-24547.2schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacke CVE-2023-245409.8Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the ch CVE-2023-245426.7Unquoted search path or element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user t CVE-2023-245448.1Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific files of the product.CVE-2023-245457.5On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service att CVE-2023-245468.1On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicio CVE-2023-245476.5On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be CVE-2023-245486.5On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in