CVE-2024-2410 is a high severity (7.6) use after free in the protobuf C++ JSON parser, in JsonToBinaryStream. Per the release notes the bug arrived in 4.22.0 and is fixed in 4.25.0 and later. Rebuild with a newer protobuf and check your dependencies.
Weakness: CWE-416 (Use After Free).
What's affected
- Affected: protobuf C++ from 4.22.0 up to before 4.25.0, per the v25.0 release notes. NVD's CPE is a wildcard for google protobuf.
- Fixed: 4.25.0 and later, in commit b955165, per the release notes.
- Attack conditions:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, network reachable with a low-privilege account.
The record says that if the input is split into separate chunks in a certain way, the parser reads bytes from a chunk that has already been freed. The release notes call it a minor issue where freed data could be copied into an error message, and say it only occurs when parsing from a stream of separate chunks, not from a contiguous array. NVD scores confidentiality impact as high, so the two sources differ on how serious it is.
How to check if you're exposed
Protobuf is a library, often compiled into other software, so it may not show in a simple package list.
- For C++ projects, check the protobuf version in your build files, Bazel or CMake config, or vcpkg and Conan lock files.
- Run
protoc --versionto read the compiler version. This is a hint, not proof, as the runtime library may differ. - Search your code for use of JsonToBinaryStream, since only that streaming path is described as affected.
- Scan the project with the free in-browser dependency scan to list dependency matches. Reachability analysis helps decide whether your code actually calls the parser.
What to do now
- Upgrade protobuf C++ to 4.25.0 or later (the v25.0 release or newer) and rebuild everything that links it statically.
- Search for callers of JsonToBinaryStream. If none exist, the risk is lower while you schedule the upgrade.
- Update container base images and vendored copies that bundle protobuf.
- Keep error messages from parsing failures out of untrusted responses.
- Record protobuf versions in your software bill of materials.
Why it matters
The record classes this as CWE-416 (Use After Free). A streaming parser receives data in chunks. If one chunk is released while an error path still points into it, the later read touches freed memory. The upstream note says the effect is that freed data may be copied into an error message, which is an information leak rather than code execution.
NVD scored it 7.6 (High). Source conflict: NVD rates the impact as high for confidentiality, while upstream calls it a minor vulnerability. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which protobuf versions are affected by CVE-2024-2410?
Per the release notes, 4.22.0 up to before 4.25.0 of the C++ implementation.
Do Python or Java users need to act?
The record describes the C++ JsonToBinaryStream function. Check your language bindings, since some bind to the C++ core, and confirm in the project notes.
Sources
- CVE-2024-2410 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2410, as held in the batch record
- protobuf v25.0 release notes
Last reviewed: 19 October 2026.
