Most recent entries from all

ALSA-2025:7138 — Moderate: protobuf security update

Affected: AlmaLinux:9: protobuf, AlmaLinux:9: protobuf-compiler, AlmaLinux:9: protobuf-devel, AlmaLinux:9: protobuf-lite, AlmaLinux:9: protobuf-lite-devel, AlmaLinux:9: python3-protobuf

The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data.

Security Fix(es):

* protobuf: message parsing vulnerability in ProtocolBuffers (CVE-2022-1941)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

bdu:2023-03839

BREW-charmcraft-CVE-2022-1941 — protobuf-cpp and protobuf-python have potential Denial of Service issue

Affected: Homebrew: charmcraft

### Summary

A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory (OOM) failure when processing a specially crafted message, which could lead to a denial of service (DoS) on services using the libraries.

Reporter: [ClusterFuzz](https://google.github.io/clusterfuzz/)

Affected versions: All versions of C++ Protobufs (including Python) prior to the versions listed below.

### Severity & Impact As scored by google **Medium 5.7** - [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Asscored byt NIST **High 7.5** - [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

A small (~500 KB) malicious payload can be constructed which causes the running service to allocate more than 3GB of RAM.

### Proof of Concept

For reproduction details, please refer to the unit test that identifies the specific inputs that exercise this parsing weakness.

### Mitigation / Patching

Please update to the latest available versions of the following packages: - protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6) - protobuf-python (3.18.3, 3.19.5, 3.20.2, 4.21.6)

certfr-2022-avi-891 — De multiples vulnérabilités ont été découvertes dans IBM QRadar. Elles permettent à un attaquant de provoquer une exécu…

certfr-2022-avi-891

CLEANSTART-2026-DG47238 — Security fix for CVE-2022-1941 applied in: pritunl 1.30.3431.73-r1

Affected: CleanStart: pritunl

Security vulnerability affects the pritunl package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-12069

fkie_cve-2022-1941

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.

GHSA-8gq9-2x98-w8hf — protobuf-cpp and protobuf-python have potential Denial of Service issue

Affected: PyPI: protobuf

### Summary

Reporter: [ClusterFuzz](https://google.github.io/clusterfuzz/)

Affected versions: All versions of C++ Protobufs (including Python) prior to the versions listed below.

A small (~500 KB) malicious payload can be constructed which causes the running service to allocate more than 3GB of RAM.

### Proof of Concept

For reproduction details, please refer to the unit test that identifies the specific inputs that exercise this parsing weakness.

### Mitigation / Patching

Please update to the latest available versions of the following packages: - protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6) - protobuf-python (3.18.3, 3.19.5, 3.20.2, 4.21.6)

gsd-2022-1941

msrc_CVE-2022-1941 — Out of Memory issue in ProtocolBuffers for cpp and python

msrc_CVE-2022-1941

OESA-2022-2010 — protobuf security update

Affected: openEuler:20.03-LTS-SP1: protobuf

Security Fix(es): A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.(CVE-2022-1941) A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.(CVE-2022-3171)

PYSEC-2026-899 — protobuf-cpp and protobuf-python have potential Denial of Service issue

Affected: PyPI: protobuf

### Summary

Reporter: [ClusterFuzz](https://google.github.io/clusterfuzz/)

Affected versions: All versions of C++ Protobufs (including Python) prior to the versions listed below.

A small (~500 KB) malicious payload can be constructed which causes the running service to allocate more than 3GB of RAM.

### Proof of Concept

For reproduction details, please refer to the unit test that identifies the specific inputs that exercise this parsing weakness.

### Mitigation / Patching

Please update to the latest available versions of the following packages: - protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6) - protobuf-python (3.18.3, 3.19.5, 3.20.2, 4.21.6)

RHSA-2025:7138 — Red Hat Security Advisory: protobuf security update

protobuf: message parsing vulnerability in ProtocolBuffers

SUSE-SU-2023:2783-2 — Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcry…

Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websockets

UBUNTU-CVE-2022-1941

Affected: Ubuntu:Pro:14.04:LTS: protobuf, Ubuntu:Pro:16.04:LTS: protobuf, Ubuntu:18.04:LTS: protobuf, Ubuntu:20.04:LTS: protobuf, Ubuntu:22.04:LTS: protobuf

WID-SEC-W-2023-0126 — Oracle MySQL: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.