HIGH7.5
GHSA-hw7c-3rfg-p46j
google.golang.org/protobuf vulnerable to panic leading to denial of service
Quick fix
GHSA-hw7c-3rfg-p46j — google.golang.org/protobuf: upgrade to the fixed version with the command below.
go get google.golang.org/protobuf@v1.29.1Details
Parsing invalid messages can panic.
Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/google.golang.org/protobuf
Introduced in:
1.29.0Fixed in: 1.29.1Fix
go get google.golang.org/protobuf@v1.29.1