From 1b7413c7ecc03125aed109dcd063520d8d66b636 Mon Sep 17 00:00:00 2001
From: Adrian Niculescu <15037449+adrian-niculescu@users.noreply.github.com>
Date: Sun, 16 Aug 2026 22:54:32 +0300
Subject: [PATCH] Bumped protobuf-javalite to 3.25.9 for CVE-2024-7254

The parser in protobuf-javalite before 3.25.5 recurses without bound on
deeply nested groups and unknown fields, throwing StackOverflowError. The
SDK parses data channel payloads with LivekitModels.DataPacket.parseFrom
in RTCEngine.onMessage, so the input is remote participant controlled.
The dependency is also declared at runtime scope in the published POM, so
it reaches the runtime classpath of every consuming app. 3.25.9 is the
latest release on that line.

Only the runtime pin moves. protobuf stays at 3.22.0: it selects protoc
and the protobuf-java jar that descriptorProtoSource unzips
descriptor.proto out of, neither of which reaches a consumer classpath,
and 3.22.0 gencode on a 3.25.9 runtime is the supported direction.
---
 .changeset/bump-protobuf-javalite.md | 5 +++++
 gradle/libs.versions.toml            | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/bump-protobuf-javalite.md

diff --git a/.changeset/bump-protobuf-javalite.md b/.changeset/bump-protobuf-javalite.md
new file mode 100644
index 000000000..919bb568b
--- /dev/null
+++ b/.changeset/bump-protobuf-javalite.md
@@ -0,0 +1,5 @@
+---
+"client-sdk-android": patch
+---
+
+Bumped protobuf-javalite to 3.25.9, which fixes the unbounded parser recursion reported as CVE-2024-7254.
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 6c3caf7b0..13b1d2666 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -22,7 +22,7 @@ lint = "30.0.1"
 okhttp = "4.12.0"
 preferenceKtx = "1.2.1"
 protobuf = "3.22.0"
-protobufJavalite = "3.22.0"
+protobufJavalite = "3.25.9"
 segmentationSelfie = "16.0.0-beta6"
 semver4j = "3.1.0"
 appcompat = "1.6.1"