A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade protobuf-lite-develUpgrade protobuf-liteUpgrade protobufUpgrade python3-protobufUpgrade protobuf-compilerUpgrade protobuf-devel | Jul 4, 2025 | Sep 22, 2022 |
| Amazon Linux Ami 2 | — | Upgrade protobuf-javadocUpgrade protobuf-javaUpgrade protobufUpgrade protobuf-emacs-elUpgrade protobuf-pythonUpgrade protobuf-lite-develUpgrade protobuf-lite-staticUpgrade protobuf-vimUpgrade protobuf-emacsUpgrade protobuf-liteUpgrade protobuf-debuginfoUpgrade protobuf-staticUpgrade protobuf-compilerUpgrade protobuf-devel | Mar 7, 2023 | Sep 22, 2022 |
| Amazon_linux_2023 | — | Upgrade protobuf-emacsUpgrade protobuf-vimUpgrade protobuf-lite-develUpgrade python3-protobuf-debuginfoUpgrade protobuf-compiler-debuginfoUpgrade python3-protobufUpgrade protobuf-debuginfoUpgrade protobuf-debugsourceUpgrade protobufUpgrade protobuf-staticUpgrade protobuf-lite-staticUpgrade protobuf-compilerUpgrade protobuf-liteUpgrade protobuf-lite-debuginfoUpgrade protobuf-devel | Feb 17, 2025 | Sep 22, 2022 |
| Debian | — | Upgrade protobuf | Apr 19, 2023 | Sep 22, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Dell Powerstore Dsa2024158 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2024 |
| Dell Powerstore Dsa2024225 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 29, 2024 |
| Dell Powerstore Dsa2024287 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jul 2, 2024 |
| Dell Powerstore Dsa2025086 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Feb 20, 2025 |
| Freebsd | — | Upgrade mysql-connector-c++Upgrade mysql-server57Upgrade mysql-client80Upgrade mysql-connector-odbcUpgrade mysql-server80Upgrade mysql-client57 | Jan 23, 2023 | Jan 21, 2023 |
| Gentoo Linux | — | Upgrade dev-libs/protobuf.Upgrade dev-python/protobuf-python. | Aug 13, 2024 | Sep 22, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade protobufUpgrade protobuf-compiler | Mar 20, 2023 | Sep 22, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade protobufUpgrade protobuf-compiler | Jan 6, 2023 | Sep 22, 2022 |
| Oracle_linux | — | Upgrade protobuf-develUpgrade protobuf-compilerUpgrade python3-protobufUpgrade protobuf-lite-develUpgrade protobuf-liteUpgrade protobuf | May 26, 2025 | Sep 22, 2022 |
| Redhat_linux | — | Upgrade python3-protobufUpgrade protobuf-develUpgrade protobuf-compilerUpgrade protobuf-lite-debuginfoUpgrade protobuf-lite-develUpgrade protobuf-debugsourceUpgrade protobuf-compiler-debuginfoUpgrade protobuf-liteUpgrade protobuf-debuginfoUpgrade protobuf | May 15, 2025 | Sep 22, 2022 |
| Rocky_linux | — | Upgrade protobuf-develUpgrade protobufUpgrade protobuf-liteUpgrade protobuf-compiler-debuginfoUpgrade protobuf-debugsourceUpgrade protobuf-lite-debuginfoUpgrade protobuf-debuginfoUpgrade protobuf-compilerUpgrade protobuf-lite-devel | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade protobuf-develUpgrade python3-protobufUpgrade libprotobuf20-32bitUpgrade python2-protobufUpgrade protobuf-javaUpgrade protobuf-sourceUpgrade libprotobuf20Upgrade libprotobuf-lite20Upgrade libprotobuf-lite20-32bitUpgrade libprotoc20 | Nov 10, 2022 | Sep 22, 2022 |
| Ubuntu | — | Upgrade libprotobuf8 (Ubuntu Pro)Upgrade protobuf-compiler (Ubuntu Pro)Upgrade libprotobuf-lite23Upgrade libprotoc-devUpgrade libprotobuf-lite9v5 (Ubuntu Pro)Upgrade libprotobuf-lite17Upgrade protobuf-compilerUpgrade libprotobuf10Upgrade python-protobufUpgrade libprotobuf-lite8 (Ubuntu Pro)Upgrade libprotoc23Upgrade libprotoc9v5 (Ubuntu Pro)Upgrade libprotobuf-lite10Upgrade libprotoc17Upgrade libprotoc8 (Ubuntu Pro)Upgrade python-protobuf (Ubuntu Pro)Upgrade libprotobuf9v5 (Ubuntu Pro)Upgrade libprotobuf-javaUpgrade python3-protobufUpgrade libprotobuf23Upgrade libprotoc10 | Dec 9, 2022 | Sep 22, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub