SIGN IN SIGN UP

Protocol Buffers - Google's data interchange format

0 0 54 C++

Add recursion depth check for TYPE_GROUP in UntypedMessage::Decode() (#26467)

UntypedMessage::Decode() in the BinaryToJson code path was missing a call to stream.IncrementRecursionDepth() for WIRETYPE_START_GROUP, allowing unbounded stack recursion via deeply nested groups. The parallel handler for TYPE_MESSAGE in DecodeDelimited() already had this check.

This is the same class of issue as CVE-2024-7254 (protobuf-java).

Fixes https://issuetracker.google.com/issues/493306525

Closes #26467

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/26467 from lonelybones:fix-group-recursion-depth 11f34c388ff97453b21116592b67b0b52e015678
PiperOrigin-RevId: 921655293
A
Andrew committed
8ae55522321aecb0c09f26cbfd0257a037c1f7cf
Parent: bca6851
Committed by Copybara-Service <copybara-worker@google.com> on 5/26/2026, 8:40:32 PM