Skip to content
OpenAdvisories
Medium RLSA-2025:7138 1 CVE

Moderate: protobuf security update

Published Oct 4, 2025 · Updated Oct 7, 2025

Ecosystem: Rocky Linux

Summary

The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data.

Security Fix(es):

* protobuf: message parsing vulnerability in ProtocolBuffers (CVE-2022-1941)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 protobuf 0:3.14.0-16.el9

Vulnerabilities 1

  • High 7.5
    CVE-2022-1941

    Out of Memory issue in ProtocolBuffers for cpp and python

    A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 fo…

    Google protobuf-python protobuf-cpp mysql Debian Ubuntu Azure Linux PyPI

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2291470