https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:06:27.590076+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2025:7138 ALSA-2025:7138 — Moderate: protobuf security update 2026-10-02T19:06:27.817613+00:00

Affected: AlmaLinux:9: protobuf, AlmaLinux:9: protobuf-compiler, AlmaLinux:9: protobuf-devel, AlmaLinux:9: protobuf-lite, AlmaLinux:9: protobuf-lite-devel, AlmaLinux:9: python3-protobuf

The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data.

Security Fix(es):

* protobuf: message parsing vulnerability in ProtocolBuffers (CVE-2022-1941)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/bdu:2023-03839 bdu:2023-03839 2026-10-02T19:06:27.817690+00:00 bdu:2023-03839 https://cve.radiocsirt.org/vuln/brew-charmcraft-cve-2022-1941 BREW-charmcraft-CVE-2022-1941 — protobuf-cpp and protobuf-python have potential Denial of Service issue 2026-10-02T19:06:27.817707+00:00

Affected: Homebrew: charmcraft

### Summary

A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory (OOM) failure when processing a specially crafted message, which could lead to a denial of service (DoS) on services using the libraries.

Reporter: [ClusterFuzz](https://google.github.io/clusterfuzz/)

Affected versions: All versions of C++ Protobufs (including Python) prior to the versions listed below.

### Severity & Impact As scored by google **Medium 5.7** - [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Asscored byt NIST **High 7.5** - [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

A small (~500 KB) malicious payload can be constructed which causes the running service to allocate more than 3GB of RAM.

### Proof of Concept

For reproduction details, please refer to the unit test that identifies the specific inputs that exercise this parsing weakness.

### Mitigation / Patching

Please update to the latest available versions of the following packages: - protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6) - protobuf-python (3.18.3, 3.19.5, 3.20.2, 4.21.6)

 https://cve.radiocsirt.org/vuln/certfr-2022-avi-891 certfr-2022-avi-891 — De multiples vulnérabilités ont été découvertes dans IBM QRadar. Elles permettent à un attaquant de provoquer une exécu… 2026-10-02T19:06:27.817749+00:00 certfr-2022-avi-891 https://cve.radiocsirt.org/vuln/cleanstart-2026-dg47238 CLEANSTART-2026-DG47238 — Security fix for CVE-2022-1941 applied in: pritunl 1.30.3431.73-r1 2026-10-02T19:06:27.817766+00:00

Affected: CleanStart: pritunl

Security vulnerability affects the pritunl package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-12069 EUVD-2026-12069 2026-10-02T19:06:27.817785+00:00 EUVD-2026-12069 https://cve.radiocsirt.org/vuln/fkie_cve-2022-1941 fkie_cve-2022-1941 2026-10-02T19:06:27.817796+00:00

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.

 https://cve.radiocsirt.org/vuln/ghsa-8gq9-2x98-w8hf GHSA-8gq9-2x98-w8hf — protobuf-cpp and protobuf-python have potential Denial of Service issue 2026-10-02T19:06:27.817820+00:00

Affected: PyPI: protobuf

### Summary

A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory (OOM) failure when processing a specially crafted message, which could lead to a denial of service (DoS) on services using the libraries.

Reporter: [ClusterFuzz](https://google.github.io/clusterfuzz/)

Affected versions: All versions of C++ Protobufs (including Python) prior to the versions listed below.

### Severity & Impact As scored by google **Medium 5.7** - [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Asscored byt NIST **High 7.5** - [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

A small (~500 KB) malicious payload can be constructed which causes the running service to allocate more than 3GB of RAM.

### Proof of Concept

For reproduction details, please refer to the unit test that identifies the specific inputs that exercise this parsing weakness.

### Mitigation / Patching

Please update to the latest available versions of the following packages: - protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6) - protobuf-python (3.18.3, 3.19.5, 3.20.2, 4.21.6)

 https://cve.radiocsirt.org/vuln/gsd-2022-1941 gsd-2022-1941 2026-10-02T19:06:27.817859+00:00 gsd-2022-1941 https://cve.radiocsirt.org/vuln/msrc_cve-2022-1941 msrc_CVE-2022-1941 — Out of Memory issue in ProtocolBuffers for cpp and python 2026-10-02T19:06:27.817870+00:00 msrc_CVE-2022-1941 https://cve.radiocsirt.org/vuln/oesa-2022-2010 OESA-2022-2010 — protobuf security update 2026-10-02T19:06:27.817886+00:00

Affected: openEuler:20.03-LTS-SP1: protobuf

Security Fix(es): A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.(CVE-2022-1941) A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.(CVE-2022-3171)

 https://cve.radiocsirt.org/vuln/pysec-2026-899 PYSEC-2026-899 — protobuf-cpp and protobuf-python have potential Denial of Service issue 2026-10-02T19:06:27.817912+00:00

Affected: PyPI: protobuf

### Summary

A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory (OOM) failure when processing a specially crafted message, which could lead to a denial of service (DoS) on services using the libraries.

Reporter: [ClusterFuzz](https://google.github.io/clusterfuzz/)

Affected versions: All versions of C++ Protobufs (including Python) prior to the versions listed below.

### Severity & Impact As scored by google **Medium 5.7** - [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Asscored byt NIST **High 7.5** - [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

A small (~500 KB) malicious payload can be constructed which causes the running service to allocate more than 3GB of RAM.

### Proof of Concept

For reproduction details, please refer to the unit test that identifies the specific inputs that exercise this parsing weakness.

### Mitigation / Patching

Please update to the latest available versions of the following packages: - protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6) - protobuf-python (3.18.3, 3.19.5, 3.20.2, 4.21.6)

 https://cve.radiocsirt.org/vuln/rhsa-2025:7138 RHSA-2025:7138 — Red Hat Security Advisory: protobuf security update 2026-10-02T19:06:27.817945+00:00

protobuf: message parsing vulnerability in ProtocolBuffers

 https://cve.radiocsirt.org/vuln/suse-su-2023:2783-2 SUSE-SU-2023:2783-2 — Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcry… 2026-10-02T19:06:27.817962+00:00

Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websockets

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-1941 UBUNTU-CVE-2022-1941 2026-10-02T19:06:27.817985+00:00

Affected: Ubuntu:Pro:14.04:LTS: protobuf, Ubuntu:Pro:16.04:LTS: protobuf, Ubuntu:18.04:LTS: protobuf, Ubuntu:20.04:LTS: protobuf, Ubuntu:22.04:LTS: protobuf

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0126 WID-SEC-W-2023-0126 — Oracle MySQL: Mehrere Schwachstellen 2026-10-02T19:06:27.818013+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.