Summary
It was discovered that Protocol Buffers incorrectly handled memory when
receiving malicious input using the Python bindings. An attacker could
possibly use this issue to cause a denial of service. (CVE-2025-4565)
It was discovered that Protocol Buffers incorrectly handled memory when
receiving malicious input using the Java bindings. An attacker could
possibly use this issue to cause a denial of service. This issue only
affected Ubuntu 25.04. (CVE-2024-7254)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | protobuf | 3.12.4-1ubuntu7.22.04.4 |
| Ubuntu · 24.04 LTS 24.04:LTS | protobuf | 3.21.12-8.2ubuntu0.2 |
Vulnerabilities 2
-
High 8.7
Stack overflow in Protocol Buffers Java Lite
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsPar…
-
High 8.2
Unbounded recursion in Python Protobuf
Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can re…