CVE-2024-7254: High Stack Overflow DoS in Protocol Buffers

CVE-2024-7254 is a High severity (7.5) denial of service flaw in Google's Protocol Buffers. Parsing untrusted data with deeply nested groups can exhaust the stack. Fixed versions are 3.25.5, 4.27.5 and 4.28.2 depending on your release line, for the Java, Kotlin and Ruby packages.

What's affected

The record describes the problem broadly: any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups, meaning a series of SGROUP tags, can be pushed past its stack limit. The recursion is unbounded in these cases:

• parsing nested groups as unknown fields with DiscardUnknownFieldsParser
• the Java Protobuf Lite parser
• parsing against Protobuf map fields

The GitHub advisory GHSA-735f-pc8j-v9w8, titled "protobuf-java has potential Denial of Service issue", lists these ranges and fixes:

• Maven com.google.protobuf:protobuf-java, protobuf-javalite, protobuf-kotlin and protobuf-kotlin-lite: versions before 3.25.5 are affected, fixed in 3.25.5. On the 4.x line, 4.0.0-RC1 up to before 4.27.5 is fixed in 4.27.5, and 4.28.0-RC1 up to before 4.28.2 is fixed in 4.28.2.
• RubyGems google-protobuf: the same three ranges, with the same fixed versions 3.25.5, 4.27.5 and 4.28.2.

The NVD record lists the Ruby package and NetApp Active IQ Unified Manager as affected products. NetApp published two advisories for its product, ntap-20241213-0010 and ntap-20250418-0006, so check those if you run it.

The record also carries three weakness classes: CWE-400 for uncontrolled resource consumption, CWE-674 for uncontrolled recursion, and CWE-787 for out of bounds write. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so the only impact scored is availability.

How to check if you're exposed

Protobuf is usually a transitive dependency, so look at the resolved tree and not only your top level manifest.

1. Maven: run mvn dependency:tree -Dincludes=com.google.protobuf and read the resolved version of each artifact.
2. Gradle: run ./gradlew dependencies --configuration runtimeClasspath and filter the output for protobuf.
3. Ruby: run bundle list and look for google-protobuf, or gem list google-protobuf on a host.
4. Container images and fat JARs: inspect the built artifact, since shaded or bundled copies will not show in the source tree.
5. Ask whether the service parses protobuf from sources you do not control, such as public APIs or uploaded files. Services that only read data you wrote yourself have a much smaller exposure.

What to do now

1. Upgrade to 3.25.5, 4.27.5 or 4.28.2, whichever matches your current line. Pin the version explicitly if a framework pulls an older one.
2. Rebuild and redeploy container images and shaded JARs, because the old classes may still be inside them.
3. Put size limits and timeouts in front of any endpoint that decodes protobuf from the internet.
4. Make sure a crash in one request handler cannot take the whole process down, and that health checks restart it quickly.
5. For vendor products that embed protobuf, follow the vendor advisory. NetApp's pages are linked below.

Why it matters

The parser calls itself for every nested group. If nothing limits the depth, a small input can force a very large number of nested calls, and the stack runs out. A stack overflow is an availability bug, and it can be triggered over the network with no login, which is why the score is 7.5.

Protobuf sits inside gRPC services, message queues and storage layers, so one vulnerable copy can be reachable in several places. That is the practical difficulty: the flaw is easy to describe and hard to inventory. The CVE is not on the CISA Known Exploited Vulnerabilities list, and no source fetched here reports exploitation.

Try it yourself

Reachability analysis helps here, since many protobuf copies never parse untrusted input.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Protocol Buffers fix commit
• GitHub advisory GHSA-735f-pc8j-v9w8
• NetApp advisory ntap-20241213-0010

Check your own dependency tree with the free in-browser scan at gold.safeguard.sh/scan.

Last reviewed: 19 October 2026.