VDB

RHSA-2026:80632

RHSA-2026:80632 PUBLISHED CVSS 5.900000095367432 MEDIUM

A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by submitting specially crafted JSON payloads to cause excessive CPU utilization and hang the application, resulting in a Denial of Service (DoS).

Risk Scores

CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red Hatskopeo-0:1.24.1-1.1.hum1@x86_64 as a component of Red Hat Hardened Images1.24.1-1.1.hum1
Red Hatskopeo-tests-0:1.24.1-1.1.hum1@x86_64 as a component of Red Hat Hardened Images1.24.1-1.1.hum1
Red Hatskopeo-0:1.24.1-1.1.hum1@s390x as a component of Red Hat Hardened Images1.24.1-1.1.hum1
Red Hatskopeo-tests-0:1.24.1-1.1.hum1@s390x as a component of Red Hat Hardened Images1.24.1-1.1.hum1
Red Hatskopeo-0:1.24.1-1.1.hum1@src as a component of Red Hat Hardened Images1.24.1-1.1.hum1
Red Hatskopeo-0:1.24.1-1.1.hum1@aarch64 as a component of Red Hat Hardened Images1.24.1-1.1.hum1
Red Hatskopeo-tests-0:1.24.1-1.1.hum1@aarch64 as a component of Red Hat Hardened Images1.24.1-1.1.hum1

Timeline

  • Oct 12, 2026 CVE Published
  • Oct 13, 2026 CVE Updated
  • Oct 13, 2026 Distribution Patch
  • Oct 13, 2026 Distribution Patch
  • Oct 13, 2026 Security Advisory
  • Oct 13, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›