Description
A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| protobuf-cpp | unspecified – ≤ 3.16.1, unspecified – ≤ 3.17.3, unspecified – ≤ 3.18.2, unspecified – ≤ 3.19.4, unspecified – ≤ 3.20.1, unspecified – ≤ 3.21.5 | — | |
| protobuf-python | unspecified – ≤ 3.16.1, unspecified – ≤ 3.17.3, unspecified – ≤ 3.18.2, unspecified – ≤ 3.19.4, unspecified – ≤ 3.20.1, unspecified – ≤ 4.21.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | protobuf | 3.21.9-3 | — |
| Debian 13 | protobuf | 3.21.9-3 | — |
| Debian 12 | protobuf | 3.21.9-3 | — |
| Debian 10 | protobuf | 3.6.1.3-2+deb10u1 | DLA-3393-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | protobuf | 3.12.4-1ubuntu7.22.04.1 | USN-5945-1 |
| Ubuntu 20.04 LTS | protobuf | 3.6.1.3-2ubuntu5.2 | USN-5945-1 |
| Ubuntu 18.04 LTS | protobuf | 3.0.0-9.1ubuntu1.1 | USN-5945-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | protobuf | 2.6.1-1.3ubuntu0.1~esm2 | USN-5769-1 |
| Ubuntu Pro 14.04 LTS | protobuf | 2.5.0-9ubuntu1+esm1 | USN-5945-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | protobuf +5 | 3.14.0-16.el9 | RHSA-2025:7138 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | protobuf +5 | 3.14.0-16.el9 | ALSA-2025:7138 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | protobuf | 3.14.0-16.el9 | RLSA-2025:7138 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | azure-cli-core | 2.17.1-150100.6.18.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP5 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP5 | python-humanfriendly | 10.0-150100.6.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP5 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP5 | python-jsondiff | 1.3.0-150100.3.6.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP5 | python-knack | 0.9.0-150100.3.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP5 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP5 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | azure-cli-core | 2.17.1-150100.6.18.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLES 15 SP4 | python-Deprecated | 1.2.13-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-PyGithub | 1.43.5-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-aiocontextvars | 0.2.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-avro | 1.11.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-cryptography-vectors | 3.3.2-150100.3.11.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-humanfriendly | 10.0-150100.6.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-jsondiff | 1.3.0-150100.3.6.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-knack | 0.9.0-150100.3.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-opencensus | 0.8.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-opencensus-context +1 | 0.1.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-opentelemetry-api | 1.5.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-websockets | 9.1-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | azure-cli-core | 2.17.1-150100.6.18.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLES 15 SP3 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-Deprecated | 1.2.13-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-PyGithub | 1.43.5-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-aiocontextvars | 0.2.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-avro | 1.11.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-humanfriendly | 10.0-150100.6.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-jsondiff | 1.3.0-150100.3.6.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-knack | 0.9.0-150100.3.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-opencensus | 0.8.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-opencensus-context +1 | 0.1.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-opentelemetry-api | 1.5.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-websockets | 9.1-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | azure-cli-core | 2.17.1-150100.6.18.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLES 15 SP2 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-Deprecated | 1.2.13-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-PyGithub | 1.43.5-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-aiocontextvars | 0.2.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-avro | 1.11.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-humanfriendly | 10.0-150100.6.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-jsondiff | 1.3.0-150100.3.6.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-knack | 0.9.0-150100.3.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-opencensus +1 | 0.8.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-opencensus-context +1 | 0.1.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-opentelemetry-api | 1.5.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-psutil | 5.9.1-150100.6.6.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-pytest | 3.10.1-150000.7.5.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-requests | 2.25.1-150100.6.13.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-websockets | 9.1-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | azure-cli-core | 2.17.1-150100.6.18.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | grpc | 1.25.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | protobuf | 3.9.2-150100.8.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-Deprecated | 1.2.13-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-PyGithub | 1.43.5-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-Twisted | 17.9.0-150000.3.8.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-avro | 1.11.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-cryptography | 3.3.2-150100.7.15.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-cryptography-vectors | 3.3.2-150100.3.11.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-google-api-core | 1.14.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-googleapis-common-protos | 1.6.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-grpcio-gcp +1 | 0.2.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-humanfriendly | 10.0-150100.6.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-jsondiff | 1.3.0-150100.3.6.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-knack | 0.9.0-150100.3.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-opencensus +1 | 0.8.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-opencensus-context +1 | 0.1.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-opentelemetry-api | 1.5.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-psutil | 5.9.1-150100.6.6.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-pytest | 3.10.1-150000.7.5.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-requests | 2.25.1-150100.6.13.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-websockets | 9.1-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
Show 22 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP3 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP3 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP3 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP3 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP3 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLES for SAP 15 SP2 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | python-psutil | 5.9.1-150100.6.6.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | python-requests | 2.25.1-150100.6.13.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | protobuf | 3.9.2-150100.8.3.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-Twisted | 17.9.0-150000.3.8.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-cryptography | 3.3.2-150100.7.15.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-psutil | 5.9.1-150100.6.6.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-requests | 2.25.1-150100.6.13.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE Real Time 15 SP3 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE Real Time 15 SP3 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE Real Time 15 SP3 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE Real Time 15 SP3 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE Real Time 15 SP3 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLE Real Time 15 SP3 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE Micro 5.3 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLE Micro 5.2 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLE Micro 5.1 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLE HPC 15 SP3 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP3 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP3 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP3 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP3 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP3 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLE HPC 15 SP2 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | python-psutil | 5.9.1-150100.6.6.3 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | python-requests | 2.25.1-150100.6.13.3 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP1 | protobuf | 3.9.2-150100.8.3.3 | SUSE-SU-2023:2783-2, SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP1 | python-cryptography | 3.3.2-150100.7.15.3 | SUSE-SU-2023:2783-2, SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP1 | python-psutil | 5.9.1-150100.6.6.3 | SUSE-SU-2023:2783-2, SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP1 | python-requests | 2.25.1-150100.6.13.3 | SUSE-SU-2023:2783-2, SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP1 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-2, SUSE-SU-2023:2783-1 |
| SUSE Manager Server Module 4.3 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Manager Server Module 4.2 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Manager Server Module 4.1 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Manager Server 4.2 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Server 4.2 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Server 4.2 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Server 4.2 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Server 4.2 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SUSE Manager Server 4.2 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Server 4.1 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Manager Retail Branch Server 4.1 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Manager Proxy 4.2 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Proxy 4.2 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Proxy 4.2 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Proxy 4.2 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Proxy 4.2 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SUSE Manager Proxy 4.2 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Proxy 4.1 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Linux Enterprise Installer Updates 15 SP2 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Linux Enterprise Installer Updates 15 SP1 | protobuf | 3.9.2-150100.8.3.3 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7.1 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7.1 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7.1 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7.1 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7.1 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7.1 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Enterprise Storage 7 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | python-psutil | 5.9.1-150100.6.6.3 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | python-requests | 2.25.1-150100.6.13.3 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | azure-cli-core | 2.17.1-150100.6.18.1 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.4 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| openSUSE Leap 15.4 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.4 | python-humanfriendly | 10.0-150100.6.3.3 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.4 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.4 | python-jsondiff | 1.3.0-150100.3.6.3 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.4 | python-knack | 0.9.0-150100.3.7.3 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.4 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.4 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.3 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.2 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | protobuf +9 | 3.19.6-1.amzn2023.0.1 | ALAS2023-2023-049 |
| Amazon Linux 2 | protobuf +12 | 2.5.0-8.amzn2.0.4 | ALAS2-2023-1973 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | keras | 3.1.1-1 | — |
| Azure Linux 3 | mysql | 8.0.40-1 | — |
| Azure Linux 3 | protobuf | 25.3-1 | — |
| Azure Linux 3 | python-tensorboard | 2.16.2-1 | — |
| Azure Linux 3 | pytorch | 2.2.2-2 | — |
| Azure Linux 3 | tensorflow | 2.16.1-1 | — |
| Azure Linux 2 (CBL-Mariner) | mysql | 8.0.40-1 | — |
| Azure Linux 2 (CBL-Mariner) | protobuf | 3.17.3-3 | — |
| Azure Linux 2 (CBL-Mariner) | pytorch | 2.0.0-7 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | protobuf +5 | 3.14.0-16.el9 | ELSA-2025-7138 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | protobuf | < 3.18.3 | 3.18.3 | GHSA-8gq9-2x98-w8hf |
| PyPI | protobuf | >= 3.19.0, < 3.19.5 | 3.19.5 | GHSA-8gq9-2x98-w8hf |
| PyPI | protobuf | >= 3.20.0, < 3.20.2 | 3.20.2 | GHSA-8gq9-2x98-w8hf |
| PyPI | protobuf | >= 4.0.0, < 4.21.6 | 4.21.6 | GHSA-8gq9-2x98-w8hf |
| PyPI | protobuf | < 3.18.3 · >= 3.19.0, < 3.19.5 · >= 3.20.0, < 3.20.2 · >= 4.0.0, < 4.21.6 | 3.18.3, 3.19.5, 3.20.2, 4.21.6 | PYSEC-2026-899 |
Advisories 15
- ALSA-2025:7138 Moderate: protobuf security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:7138 Red Hat Security Advisory: protobuf security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- USN-5945-1 protobuf vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- WID-SEC-2023-0126 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 28, 2026
- USN-5769-1 protobuf vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-3393-1 protobuf - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2023:2783-2 Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websoc SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2783-1 Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websoc SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3922-1 Security update for protobuf SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- RLSA-2025:7138 Moderate: protobuf security update Rocky Linux Security Advisories · Oct 7, 2025
- ELSA-2025-7138 Moderate: protobuf security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 16, 2025
- WID-SEC-2023-2902 IBM Security Guardium: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 14, 2023
- ALAS2-2023-1973 Moderate: protobuf security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 7, 2023
- ALAS2023-2023-049 Important: protobuf security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
References
- https://cloud.google.com/support/bulletins#GCP-2022-019
- https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8gq9-2x98-w8hf
- [oss-security] 20220927 CVE-2022-1941: Protobuf C++, Python DoS mailing-list
- FEDORA-2022-25f35ed634 vendor-advisory
- [debian-lts-announce] 20230418 [SECURITY] [DLA 3393-1] protobuf security update mailing-list
- FEDORA-2022-15729fa33d vendor-advisory
- https://security.netapp.com/advisory/ntap-20240705-0001/