Description
The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream. If the input is broken up into separate chunks in a certain way, the parser will attempt to read bytes from a chunk that has already been freed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| protocolbuffers | protobuf | 4.22.0 – < 4.25.0 | 4.25.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | protobuf | 23.4-slfo.1.1_2.1 | SUSE-SU-2025:20672-1 |
| SLE Micro 6.0 | protobuf | 23.4-9.1 | SUSE-SU-2025:20155-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | mysql | 8.0.40-2 | — |
| Azure Linux 2 (CBL-Mariner) | mysql | 8.0.40-2 | — |
Advisories 2
- SUSE-SU-2025:20672-1 Security update for protobuf SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20155-1 Security update for protobuf SUSE / openSUSE Security Updates · Mar 23, 2026