Protobuf

Source repositories

CVE	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2015-5237	Hig	0.57	8.8	0.01	Sep 25, 2017	protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
CVE-2026-0994	Hig	0.42	7.5	0.00	Jan 23, 2026	A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
CVE-2021-22570		0.00	—	0.00	Jan 26, 2022	Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.