Description
Nanopb is a small code-size Protocol Buffers implementation. When the compile time option PB_ENABLE_MALLOC is enabled, the message contains at least one field with FT_POINTER field type, custom stream callback is used with unknown stream length. and the pb_decode_ex() function is used with flag PB_DECODE_DELIMITED, then the pb_decode_ex() function does not automatically call pb_release(), like is done for other failure cases. This could lead to memory leak and potential denial-of-service. This vulnerability is fixed in 0.4.9.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nanopb | nanopb | >=0.4.0, < 0.4.9.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nanopb | 0.4.9.1-1 | — |
| Debian 13 | nanopb | 0.4.9.1-1 | — |
| Debian 12 | nanopb | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | nanopb | No fix yet | — |
| Ubuntu 26.04 LTS | nanopb | No fix yet | — |
| Ubuntu 25.10 | nanopb | No fix yet | — |
| Ubuntu 24.04 LTS | nanopb | No fix yet | — |
| Ubuntu 22.04 LTS | nanopb | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | nanopb | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP6 | nanopb | 0.4.6-bp156.4.3.1 | openSUSE-SU-2024:0400-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | nanopb | 0.4.6-bp156.4.3.1 | openSUSE-SU-2024:0400-1 |
Advisories 1
- openSUSE-SU-2024:0400-1 Security update for nanopb SUSE / openSUSE Security Updates · Feb 4, 2026