A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-protobufUpgrade protobuf-develUpgrade protobuf-compilerUpgrade protobuf-lite-develUpgrade protobufUpgrade protobuf-lite | Jul 4, 2025 | Sep 22, 2022 |
| Amazon Linux Ami 2 | — | Upgrade protobuf-compilerUpgrade protobuf-debuginfoUpgrade protobuf-develUpgrade protobuf-staticUpgrade protobuf-javadocUpgrade protobuf-lite-staticUpgrade protobufUpgrade protobuf-vimUpgrade protobuf-emacsUpgrade protobuf-javaUpgrade protobuf-liteUpgrade protobuf-pythonUpgrade protobuf-lite-develUpgrade protobuf-emacs-el | Mar 7, 2023 | Sep 22, 2022 |
| Amazon_linux_2023 | — | Upgrade protobuf-emacsUpgrade python3-protobuf-debuginfoUpgrade protobuf-vimUpgrade protobuf-compiler-debuginfoUpgrade python3-protobufUpgrade protobuf-lite-develUpgrade protobuf-liteUpgrade protobuf-lite-staticUpgrade protobuf-lite-debuginfoUpgrade protobuf-debugsourceUpgrade protobufUpgrade protobuf-compilerUpgrade protobuf-staticUpgrade protobuf-develUpgrade protobuf-debuginfo | Feb 17, 2025 | Sep 22, 2022 |
| Debian | — | Upgrade protobuf | Apr 19, 2023 | Sep 22, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Dell Powerstore Dsa2024158 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2024 |
| Dell Powerstore Dsa2024225 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 29, 2024 |
| Dell Powerstore Dsa2024287 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jul 2, 2024 |
| Dell Powerstore Dsa2025086 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Feb 20, 2025 |
| Freebsd | — | Upgrade mysql-server80Upgrade mysql-client57Upgrade mysql-connector-odbcUpgrade mysql-client80Upgrade mysql-connector-c++Upgrade mysql-server57 | Jan 23, 2023 | Jan 21, 2023 |
| Gentoo Linux | — | Upgrade dev-libs/protobuf.Upgrade dev-python/protobuf-python. | Aug 13, 2024 | Sep 22, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade protobufUpgrade protobuf-compiler | Mar 20, 2023 | Sep 22, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade protobuf-compilerUpgrade protobuf | Jan 6, 2023 | Sep 22, 2022 |
| Oracle_linux | — | Upgrade protobuf-liteUpgrade protobufUpgrade protobuf-compilerUpgrade protobuf-develUpgrade python3-protobufUpgrade protobuf-lite-devel | May 26, 2025 | Sep 22, 2022 |
| Redhat_linux | — | Upgrade python3-protobufUpgrade protobuf-lite-develUpgrade protobuf-develUpgrade protobuf-compilerUpgrade protobuf-lite-debuginfoUpgrade protobuf-debugsourceUpgrade protobuf-compiler-debuginfoUpgrade protobuf-liteUpgrade protobufUpgrade protobuf-debuginfo | May 15, 2025 | Sep 22, 2022 |
| Rocky_linux | — | Upgrade protobuf-develUpgrade protobufUpgrade protobuf-liteUpgrade protobuf-lite-debuginfoUpgrade protobuf-debuginfoUpgrade protobuf-compiler-debuginfoUpgrade protobuf-lite-develUpgrade protobuf-compilerUpgrade protobuf-debugsource | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade libprotobuf-lite20Upgrade protobuf-sourceUpgrade libprotobuf-lite20-32bitUpgrade libprotobuf20Upgrade libprotoc20Upgrade libprotobuf20-32bitUpgrade protobuf-javaUpgrade python2-protobufUpgrade python3-protobufUpgrade protobuf-devel | Nov 10, 2022 | Sep 22, 2022 |
| Ubuntu | — | Upgrade python-protobuf (Ubuntu Pro)Upgrade libprotobuf9v5 (Ubuntu Pro)Upgrade libprotoc17Upgrade libprotoc8 (Ubuntu Pro)Upgrade libprotobuf23Upgrade libprotoc10Upgrade libprotobuf-lite10Upgrade python3-protobufUpgrade libprotobuf-javaUpgrade libprotoc-devUpgrade libprotoc23Upgrade libprotobuf10Upgrade libprotobuf8 (Ubuntu Pro)Upgrade libprotoc9v5 (Ubuntu Pro)Upgrade libprotobuf-lite9v5 (Ubuntu Pro)Upgrade protobuf-compiler (Ubuntu Pro)Upgrade python-protobufUpgrade libprotobuf-lite8 (Ubuntu Pro)Upgrade libprotobuf-lite23Upgrade libprotobuf-lite17Upgrade protobuf-compiler | Dec 9, 2022 | Sep 22, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub