title: Infinite loop in JSON unmarshaling in google.golang.org/protobuf
description: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
problem types: CWE-1286: Improper Validation of Syntactic Correctness of Input
affected:
{
vendor: google.golang.org/protobuf
product: google.golang.org/protobuf/encoding/protojson
collectionURL: https://pkg.go.dev
packageName: google.golang.org/protobuf/encoding/protojson
versions:
version: 0, lessThan: 1.33.0, status: affected, versionType: semver
programRoutines:
name: UnmarshalOptions.unmarshal
name: Unmarshal
name: UnmarshalOptions.Unmarshal
defaultStatus: unaffected
}
{
vendor: google.golang.org/protobuf
product: google.golang.org/protobuf/internal/encoding/json
collectionURL: https://pkg.go.dev
packageName: google.golang.org/protobuf/internal/encoding/json
versions:
version: 0, lessThan: 1.33.0, status: affected, versionType: semver
programRoutines:
name: Decoder.Read
name: Decoder.Peek
defaultStatus: unaffected
}
