Google Protobuf vulnerabilities

CVE-2015-5237 [HIGH] CWE-787 CVE-2015-5237: protobuf allows remote authenticated attackers to cause a heap-based buffer overflow. protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

CVE-2024-7254 [HIGH] CWE-400 CVE-2024-7254: Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested gro Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions t

CVE-2026-0994 [HIGH] CWE-674 CVE-2026-0994: A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the i

CVE-2024-2410 [CRITICAL] CWE-416 CVE-2024-2410: The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream. If the input is broken up into separate chunks in a certain way, the parser will attempt to read bytes from a chunk that has already been freed.

CVE-2022-1941 [HIGH] CWE-119 protobuf-cpp and protobuf-python have potential Denial of Service issue protobuf-cpp and protobuf-python have potential Denial of Service issue ### Summary A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory (OOM) failure when processing a specially crafted message, which could lead to a denial of service (DoS) on services using the libraries. Reporter: [ClusterFuzz](https://google.g

CVE-2022-3171 [HIGH] CVE-2022-3171: A parsing issue with binary data in protobuf-java core and lite versions prior to 3 A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage co

CVE-2022-3509 [HIGH] CVE-2022-3509: A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3 A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and

CVE-2022-3510 [HIGH] CVE-2022-3510: A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3 A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n

CVE-2019-15544 [HIGH] CWE-770 Uncontrolled memory consumption in protobuf Uncontrolled memory consumption in protobuf Affected versions of this crate called Vec::reserve() on user-supplied input. This allows an attacker to cause an Out of Memory condition while calling the vulnerable method on untrusted data.

CVE-2026-6409 [HIGH] CWE-400 Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion ### Impact A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative `varint`s or deep recursion—can be used to crash the applica

CVE-2025-4565 [HIGH] CWE-674 protobuf-python has a potential Denial of Service issue protobuf-python has a potential Denial of Service issue ### Summary Any project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of **recursive groups**, **recursive messages** or **a series of [`SGROUP`](https://protobuf.dev/programming-guides/encoding/#groups) tags** can be corrupted by exceeding the Python recursion limit. Reporter: Alexis Challa

CVE-2025-53605 [MEDIUM] CWE-20 Crash due to uncontrolled recursion in protobuf crate Crash due to uncontrolled recursion in protobuf crate Affected version of this crate did not properly parse unknown fields when parsing a user-supplied input. This allows an attacker to cause a stack overflow when parsing the message on untrusted data.

CVE-2021-22570 [MEDIUM] CWE-476 CVE-2021-22570: Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

CVE-2021-22569 [MEDIUM] CVE-2021-22569: An issue in protobuf-java allowed the interleaving of com An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

CVE-2026-54451 [HIGH] CWE-674 Protobuf: Unbounded recursion depth in embedded-message decoding Protobuf: Unbounded recursion depth in embedded-message decoding ### Summary Unbounded recursion depth in `Protobuf.Decoder` (Hex package `protobuf`, versions `>= 0.8.0, >` (tag `0x0A` = field 1, wire type 2). Use an iolist with a running byte-size to keep generation O(depth). 3. POST the body (a few MB at `depth = 1_000_000`) as `application/x-protobuf` to any endpoint that calls `Tree.decode/1`. 4.