protobuf-cpp and protobuf-python have potential Denial of Service issue
Summary
A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory (OOM) failure when processing a specially crafted message, which could lead to a denial of service (DoS) on services using the libraries.
Reporter: ClusterFuzz
Affected versions: All versions of C++ Protobufs (including Python) prior to the versions listed below.
Severity & Impact
As scored by google
Medium 5.7 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Asscored byt NIST
High 7.5 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A small (~500 KB) malicious payload can be constructed which causes the running service to allocate more than 3GB of RAM.
Proof of Concept
For reproduction details, please refer to the unit test that identifies the specific inputs that exercise this parsing weakness.
Mitigation / Patching
Please update to the latest available versions of the following packages:
- protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6)
- protobuf-python (3.18.3, 3.19.5, 3.20.2, 4.21.6)
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | protobuf | < 3.18.3, >= 3.19.0, < 3.19.5, >= 3.20.0, < 3.20.2, >= 4.0.0, < 4.21.6 | 3.18.3, 3.19.5, 3.20.2, 4.21.6 |
Referencias
- https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8gq9-2x98-w8hf
- https://nvd.nist.gov/vuln/detail/CVE-2022-1941
- https://cloud.google.com/support/bulletins#GCP-2022-019
- https://github.com/protocolbuffers/protobuf
- https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP
- https://security.netapp.com/advisory/ntap-20240705-0001
- http://www.openwall.com/lists/oss-security/2022/09/27/1
- https://pypi.org/project/protobuf
- https://github.com/advisories/GHSA-8gq9-2x98-w8hf
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Debilidad (CWE)
CWE-119, CWE-1286- Plataforma
- Python (PyPI)
- Paquete
protobuf- Publicada
- 23.09.2022
- Actualizado
- 11.10.2026 13:19
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-899 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-8gq9-2x98-w8hf - CC BY 4.0
Historial de vulnerabilidades: protobuf
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 5
- Primera → última
- 09.2017 01.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 5
Divulgaciones por año
- 2017: 1
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 2
- 2023: 0
- 2024: 0
- 2025: 1
- 2026: 1
-
protobuf-cpp and protobuf-python have potential Denial of Service issue esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.