« Volver al listado

CVE-2024-53984

Estado: AplazadaMedia (4.3)—

Nanopb is a small code-size Protocol Buffers implementation. When the compile time option PB_ENABLE_MALLOC is enabled, the message contains at least one field with FT_POINTER field type, custom stream callback is used with unknown stream length. and the pb_decode_ex() function is used with flag PB_DECODE_DELIMITED, then the pb_decode_ex() function does not automatically call pb_release(), like is done for other failure cases. This could lead to memory leak and potential denial-of-service. This vulnerability is fixed in 0.4.9.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Nanopb — NanopbAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-53984",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-53984",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-02T21:39:54.790040Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "nanopb",
          "product": "nanopb",
          "versions": [
            {
              "status": "affected",
              "version": ">=0.4.0, < 0.4.9.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-12-02T16:15:14.603",
  "references": [
    {
      "url": "https://github.com/nanopb/nanopb/commit/2b86c255aa52250438d5aba124d0e86db495b378",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nanopb/nanopb/security/advisories/GHSA-xwqq-qxmw-hj5r",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        },
        {
          "lang": "en",
          "value": "CWE-755"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nanopb is a small code-size Protocol Buffers implementation.  When the compile time option PB_ENABLE_MALLOC is enabled, the message contains at least one field with FT_POINTER field type, custom stream callback is used with unknown stream length. and the pb_decode_ex() function is used with flag PB_DECODE_DELIMITED, then the pb_decode_ex() function does not automatically call pb_release(), like is done for other failure cases. This could lead to memory leak and potential denial-of-service. This vulnerability is fixed in 0.4.9.1."
    },
    {
      "lang": "es",
      "value": "Nanopb es una implementación de Protocol Buffers de tamaño de código pequeño. Cuando la opción de tiempo de compilación PB_ENABLE_MALLOC está habilitada, el mensaje contiene al menos un campo con el tipo de campo FT_POINTER, se utiliza una devolución de llamada de flujo personalizada con una longitud de flujo desconocida y la función pb_decode_ex() se utiliza con el indicador PB_DECODE_DELIMITED, entonces la función pb_decode_ex() no llama automáticamente a pb_release(), como se hace para otros casos de falla. Esto podría provocar una pérdida de memoria y una posible denegación de servicio. Esta vulnerabilidad se corrigió en la versión 0.4.9.1."
    }
  ],
  "lastModified": "2026-06-17T08:09:36.963",
  "sourceIdentifier": "security-advisories@github.com"
}