Google Protobuf
5 CVEs affecting Google Protobuf. Latest disclosed: 2026-01-23. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-5237 | High | 8.8 | 2017-09-25 | protobuf allows remote authenticated attackers to cause a heap-based buffer overflow. |
CVE-2024-2410 | High | 7.6 | 2024-05-03 | The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream. If the input is broken up into se… |
CVE-2026-0994 | High | 7.5 | 2026-01-23 | A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when p… |
CVE-2024-7254 | High | 7.5 | 2024-09-19 | Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the… |
CVE-2021-22570 | Medium | 6.5 | 2022-01-26 | Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name du… |