CVE-2024-7254 protobuf-java has potential Denial of Service issue

[sklinkert]

(from dependabot / GHAS)

Severity: 8.7/10
Package: com.google.protobuf:protobuf-java
Affected versions: < 3.25.5
Patched version: 3.25.5

CVE-2024-7254 High CVSS4.0 Score 8.7

This is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.