VDB
RHSA-2025%3A0664
RHSA-2025%3A0664
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in Golang's protobuf module, where the unmarshal function can enter an infinite loop when processing certain invalid inputs. This issue occurs during unmarshaling into a message that includes a google.protobuf.Any or when the UnmarshalOptions.DiscardUnknown option is enabled. This flaw allows an attacker to craft malicious input tailored to trigger the identified flaw in the unmarshal function. By providing carefully constructed invalid inputs, they could potentially cause the function to enter an infinite loop, resulting in a denial of service condition or other unintended behaviors in the affected system.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-serverless-1/logic-rhel8-operator@sha256:cb4dbd05449296fe6cdd8c5b54375b4f856d4d4ba4a0b634df370a248ba19820_arm64 as a component of 8Base-Openshift-Serverless-1.35 | openshift-serverless-1/logic-rhel8-operator@sha256:cb4dbd05449296fe6cdd8c5b54375b4f856d4d4ba4a0b634df370a248ba19820_arm64, openshift-serverless-1/logic-rhel8-operator@sha256:cb4dbd05449296fe6cdd8c5b54375b4f856d4d4ba4a0b634df370a248ba19820_arm64, openshift-serverless-1/logic-rhel8-operator@sha256:cb4dbd05449296fe6cdd8c5b54375b4f856d4d4ba4a0b634df370a248ba19820_arm64 |
| Red Hat | openshift-serverless-1/logic-data-index-postgresql-rhel8@sha256:329594c53c4a745faf4d0cf5e545d67330c0aeae6ac00b64e9ec0f8ce0df184b_ppc64le as a component of 8Base-Openshift-Serverless-1.35 | openshift-serverless-1/logic-data-index-postgresql-rhel8@sha256:329594c53c4a745faf4d0cf5e545d67330c0aeae6ac00b64e9ec0f8ce0df184b_ppc64le, openshift-serverless-1/logic-data-index-postgresql-rhel8@sha256:329594c53c4a745faf4d0cf5e545d67330c0aeae6ac00b64e9ec0f8ce0df184b_ppc64le, * |
| Red Hat | openshift-serverless-1/logic-swf-devmode-rhel8@sha256:7438efe5d9db033e410419ec6e7620a268192762a65d825c91950cd4a629c46f_arm64 as a component of 8Base-Openshift-Serverless-1.35 | openshift-serverless-1/logic-swf-devmode-rhel8@sha256:7438efe5d9db033e410419ec6e7620a268192762a65d825c91950cd4a629c46f_arm64, *, * |
| Red Hat | openshift-serverless-1/logic-data-index-ephemeral-rhel8@sha256:56afce3767c0107b1d8eddb0e11349b9d590c22ebfee7a549f627c49136992d4_amd64 as a component of 8Base-Openshift-Serverless-1.35 | *, *, openshift-serverless-1/logic-data-index-ephemeral-rhel8@sha256:56afce3767c0107b1d8eddb0e11349b9d590c22ebfee7a549f627c49136992d4_amd64 |
| Red Hat | openshift-serverless-1/logic-management-console-rhel8@sha256:b78d197751ef9cfdbd57d682f3478f87c6bb4786a72c72f3e33762576ce0a204_amd64 as a component of 8Base-Openshift-Serverless-1.35 | openshift-serverless-1/logic-management-console-rhel8@sha256:b78d197751ef9cfdbd57d682f3478f87c6bb4786a72c72f3e33762576ce0a204_amd64, openshift-serverless-1/logic-management-console-rhel8@sha256:b78d197751ef9cfdbd57d682f3478f87c6bb4786a72c72f3e33762576ce0a204_amd64, openshift-serverless-1/logic-management-console-rhel8@sha256:b78d197751ef9cfdbd57d682f3478f87c6bb4786a72c72f3e33762576ce0a204_amd64 |
| Red Hat | openshift-serverless-1/logic-swf-builder-rhel8@sha256:033cb5cf3fedea187bd9f72aa45ff081f7c9825b4e4235010172ce6a12610e8a_amd64 as a component of 8Base-Openshift-Serverless-1.35 | *, *, * |
| Red Hat | openshift-serverless-1/logic-operator-bundle@sha256:13d391b2a921dcc79d38a452dfd3924c77a972a7cedae2a547a3820345c606c8_arm64 as a component of 8Base-Openshift-Serverless-1.35 | openshift-serverless-1/logic-operator-bundle@sha256:13d391b2a921dcc79d38a452dfd3924c77a972a7cedae2a547a3820345c606c8_arm64, *, * |
| Red Hat | openshift-serverless-1/logic-swf-builder-rhel8@sha256:a1e75bc27adcbc4df57f4fdc289ca2eafd0fef9b87b2a78fcc523860a40aea0d_ppc64le as a component of 8Base-Openshift-Serverless-1.35 | openshift-serverless-1/logic-swf-builder-rhel8@sha256:a1e75bc27adcbc4df57f4fdc289ca2eafd0fef9b87b2a78fcc523860a40aea0d_ppc64le, *, openshift-serverless-1/logic-swf-builder-rhel8@sha256:a1e75bc27adcbc4df57f4fdc289ca2eafd0fef9b87b2a78fcc523860a40aea0d_ppc64le |
| Red Hat | openshift-serverless-1/logic-rhel8-operator@sha256:cb4dbd05449296fe6cdd8c5b54375b4f856d4d4ba4a0b634df370a248ba19820_arm64 as a component of 8Base-Openshift-Serverless-1.35 | *, openshift-serverless-1/logic-rhel8-operator@sha256:cb4dbd05449296fe6cdd8c5b54375b4f856d4d4ba4a0b634df370a248ba19820_arm64, openshift-serverless-1/logic-rhel8-operator@sha256:cb4dbd05449296fe6cdd8c5b54375b4f856d4d4ba4a0b634df370a248ba19820_arm64 |
| Red Hat | openshift-serverless-1/logic-swf-devmode-rhel8@sha256:35877fb2aae353f2ed57f7a975a45f510fdf0cf8dc0070e52b47ed590af0f0b8_amd64 as a component of 8Base-Openshift-Serverless-1.35 | openshift-serverless-1/logic-swf-devmode-rhel8@sha256:35877fb2aae353f2ed57f7a975a45f510fdf0cf8dc0070e52b47ed590af0f0b8_amd64, openshift-serverless-1/logic-swf-devmode-rhel8@sha256:35877fb2aae353f2ed57f7a975a45f510fdf0cf8dc0070e52b47ed590af0f0b8_amd64, openshift-serverless-1/logic-swf-devmode-rhel8@sha256:35877fb2aae353f2ed57f7a975a45f510fdf0cf8dc0070e52b47ed590af0f0b8_amd64 |
| Red Hat | openshift-serverless-1/logic-rhel8-operator@sha256:35fa091442aea7a9b5bbff8581d51a954fc8a1c0d9c411de91ec547cb6b3d762_amd64 as a component of 8Base-Openshift-Serverless-1.35 | *, openshift-serverless-1/logic-rhel8-operator@sha256:35fa091442aea7a9b5bbff8581d51a954fc8a1c0d9c411de91ec547cb6b3d762_amd64, openshift-serverless-1/logic-rhel8-operator@sha256:35fa091442aea7a9b5bbff8581d51a954fc8a1c0d9c411de91ec547cb6b3d762_amd64 |
| Red Hat | openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8@sha256:89282abb48abfecd20634112d03450452c795a33c22f43dca2582cb30055b490_amd64 as a component of 8Base-Openshift-Serverless-1.35 | *, openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8@sha256:89282abb48abfecd20634112d03450452c795a33c22f43dca2582cb30055b490_amd64, openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8@sha256:89282abb48abfecd20634112d03450452c795a33c22f43dca2582cb30055b490_amd64 |
| Red Hat | openshift-serverless-1/logic-jobs-service-ephemeral-rhel8@sha256:e072472c48308e24fe8065837277a6886bd52ece5209dfcaf91bd29390d1f46a_arm64 as a component of 8Base-Openshift-Serverless-1.35 | *, *, * |
| Red Hat | openshift-serverless-1/logic-data-index-postgresql-rhel8@sha256:ef1070b9c74786f739aeca2bbb9e3a47737fe6fb94b914a66e87919dfa9d6e74_amd64 as a component of 8Base-Openshift-Serverless-1.35 | *, *, * |
| Red Hat | openshift-serverless-1/logic-swf-builder-rhel8@sha256:a1e75bc27adcbc4df57f4fdc289ca2eafd0fef9b87b2a78fcc523860a40aea0d_ppc64le as a component of 8Base-Openshift-Serverless-1.35 | *, openshift-serverless-1/logic-swf-builder-rhel8@sha256:a1e75bc27adcbc4df57f4fdc289ca2eafd0fef9b87b2a78fcc523860a40aea0d_ppc64le, openshift-serverless-1/logic-swf-builder-rhel8@sha256:a1e75bc27adcbc4df57f4fdc289ca2eafd0fef9b87b2a78fcc523860a40aea0d_ppc64le |
| Red Hat | openshift-serverless-1/logic-jobs-service-postgresql-rhel8@sha256:2ca2a45af55aef2a611e42106ee1deec6b77c143b41e4eabdd845b51661eb7e6_amd64 as a component of 8Base-Openshift-Serverless-1.35 | openshift-serverless-1/logic-jobs-service-postgresql-rhel8@sha256:2ca2a45af55aef2a611e42106ee1deec6b77c143b41e4eabdd845b51661eb7e6_amd64, *, openshift-serverless-1/logic-jobs-service-postgresql-rhel8@sha256:2ca2a45af55aef2a611e42106ee1deec6b77c143b41e4eabdd845b51661eb7e6_amd64 |
| Red Hat | openshift-serverless-1/logic-data-index-ephemeral-rhel8@sha256:d7e430549b5bb731d2dcdfe035eaad09749a715a20fb317f0a298c2816416993_ppc64le as a component of 8Base-Openshift-Serverless-1.35 | *, openshift-serverless-1/logic-data-index-ephemeral-rhel8@sha256:d7e430549b5bb731d2dcdfe035eaad09749a715a20fb317f0a298c2816416993_ppc64le, openshift-serverless-1/logic-data-index-ephemeral-rhel8@sha256:d7e430549b5bb731d2dcdfe035eaad09749a715a20fb317f0a298c2816416993_ppc64le |
| Red Hat | openshift-serverless-1/logic-management-console-rhel8@sha256:b78d197751ef9cfdbd57d682f3478f87c6bb4786a72c72f3e33762576ce0a204_amd64 as a component of 8Base-Openshift-Serverless-1.35 | *, openshift-serverless-1/logic-management-console-rhel8@sha256:b78d197751ef9cfdbd57d682f3478f87c6bb4786a72c72f3e33762576ce0a204_amd64, openshift-serverless-1/logic-management-console-rhel8@sha256:b78d197751ef9cfdbd57d682f3478f87c6bb4786a72c72f3e33762576ce0a204_amd64 |
| Red Hat | openshift-serverless-1/logic-jobs-service-ephemeral-rhel8@sha256:5821f6a8b84797f2786d88be10bcd064576e589ea3c57d1db90d100007322fd8_amd64 as a component of 8Base-Openshift-Serverless-1.35 | openshift-serverless-1/logic-jobs-service-ephemeral-rhel8@sha256:5821f6a8b84797f2786d88be10bcd064576e589ea3c57d1db90d100007322fd8_amd64, openshift-serverless-1/logic-jobs-service-ephemeral-rhel8@sha256:5821f6a8b84797f2786d88be10bcd064576e589ea3c57d1db90d100007322fd8_amd64, * |
| Red Hat | openshift-serverless-1/logic-swf-devmode-rhel8@sha256:ff2bc62c20412ba5e7dcb4c71f9b6c56a250766e59031444461e5f4d626aa106_ppc64le as a component of 8Base-Openshift-Serverless-1.35 | openshift-serverless-1/logic-swf-devmode-rhel8@sha256:ff2bc62c20412ba5e7dcb4c71f9b6c56a250766e59031444461e5f4d626aa106_ppc64le, openshift-serverless-1/logic-swf-devmode-rhel8@sha256:ff2bc62c20412ba5e7dcb4c71f9b6c56a250766e59031444461e5f4d626aa106_ppc64le, openshift-serverless-1/logic-swf-devmode-rhel8@sha256:ff2bc62c20412ba5e7dcb4c71f9b6c56a250766e59031444461e5f4d626aa106_ppc64le |
…and 34 more
Timeline
- Jan 23, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 16, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:0664 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2268046 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2301456 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2310908 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0664.json advisory
- https://access.redhat.com/security/cve/CVE-2024-24786 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-24786 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-24786 advisory
- https://go.dev/cl/569356 advisory
- https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/ advisory
- https://pkg.go.dev/vuln/GO-2024-2611 advisory
- https://access.redhat.com/security/cve/CVE-2024-40094 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-40094 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-40094 advisory
- https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a advisory
- https://github.com/graphql-java/graphql-java/discussions/3641 advisory
- https://github.com/graphql-java/graphql-java/pull/3539 advisory
- https://github.com/graphql-java/graphql-java/releases/tag/v19.11 advisory
- https://github.com/graphql-java/graphql-java/releases/tag/v20.9 advisory
…and 7 more