Description
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Protocol Buffers | < 28.2 | 28.2 | |
| protobuf-java | < 3.25.5, < 4.27.5, < 4.28.2 | 3.25.5 | |
| protobuf-javalite | < 3.25.5, < 4.27.5, < 4.28.2 | 3.25.5 | |
| protobuf-kotlin | < 3.25.5, < 4.27.5, < 4.28.2 | 3.25.5 | |
| protobuf-kotllin-lite | < 3.25.5, < 4.27.5, < 4.28.2 | 3.25.5 | |
| google-protobuf [JRuby Gem] | < 3.25.5, < 4.27.5, < 4.28.2 | 3.25.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | protobuf | 3.21.12-12 | — |
| Debian 13 | protobuf | 3.21.12-11+deb13u1 | — |
| Debian 12 | protobuf | 3.21.12-3+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | protobuf | 3.21.12-8.2ubuntu0.1 | USN-7629-1, USN-7435-1 |
| Ubuntu 22.04 LTS | protobuf | 3.12.4-1ubuntu7.22.04.2 | USN-7629-1, USN-7435-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | protobuf | 3.6.1.3-2ubuntu5.2+esm2 | USN-7629-2 |
| Ubuntu Pro 18.04 LTS | protobuf | 3.0.0-9.1ubuntu1.1+esm3 | USN-7629-2 |
| Ubuntu Pro 16.04 LTS | protobuf | 2.6.1-1.3ubuntu0.1~esm4 | USN-7629-2 |
| Ubuntu Pro 14.04 LTS | protobuf | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-apache-cxf +3 | 3.5.11-1.SP1_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-eclipse-jgit | 5.13.5.202508271544-2.r_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-hibernate +4 | 5.3.38-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jboss-marshalling +1 | 2.0.16-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-netty +26 | 4.1.124-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-protostream | 4.3.7-1.Final_redhat_00001.1.el7eap | RHSA-2025:20052 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-undertow | 2.2.39-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly +4 | 7.4.23-5.GA_redhat_00004.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly-java-jdk17 | 7.4.23-5.GA_redhat_00004.1.el8eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2025:20052 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | protobuf | 25.1-150600.16.7.1 | SUSE-SU-2024:3745-1 |
| SLES 15 SP5 | protobuf | 25.1-150500.12.5.1 | SUSE-SU-2024:3747-1 |
| SLES 15 SP4 | protobuf | 25.1-150400.9.10.1 | SUSE-SU-2024:3746-1 |
| SLES 3 | protobuf | 25.1-150500.12.5.1 | SUSE-SU-2024:3747-1, SUSE-SU-2024:3745-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP4 | protobuf | 25.1-150400.9.10.1 | SUSE-SU-2024:3746-1 |
| SLE Micro 6.1 | protobuf | 23.4-slfo.1.1_2.1 | SUSE-SU-2025:20672-1 |
| SLE Micro 6.0 | protobuf | 23.4-8.1 | SUSE-SU-2025:20074-1 |
| SLE Micro 5.5 | protobuf | 25.1-150500.12.5.1 | SUSE-SU-2024:3747-1 |
| SLE Micro 5.4 | protobuf | 25.1-150400.9.10.1 | SUSE-SU-2024:3746-1 |
| SLE Micro 5.3 | protobuf | 25.1-150400.9.10.1 | SUSE-SU-2024:3746-1 |
| SLE HPC 15 SP4 | protobuf | 25.1-150400.9.10.1 | SUSE-SU-2024:3746-1 |
| SUSE Manager Server 4.3 | protobuf | 25.1-150400.9.10.1 | SUSE-SU-2024:3746-1 |
| SUSE Linux Enterprise Installer Updates 15 SP5 | protobuf | 25.1-150500.12.5.1 | SUSE-SU-2024:3747-1 |
| SUSE Linux Enterprise Installer Updates 15 SP4 | protobuf | 25.1-150400.9.10.1 | SUSE-SU-2024:3746-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | protobuf | 28.3-15.1 | openSUSE-SU-2025:14832-1 |
| openSUSE Leap 15.6 | protobuf | 25.1-150600.16.7.1 | SUSE-SU-2024:3745-1 |
| openSUSE Leap 15.5 | protobuf | 25.1-150500.12.5.1 | SUSE-SU-2024:3747-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.5 | protobuf | 25.1-150500.12.5.1 | SUSE-SU-2024:3747-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | protobuf +12 | 2.5.0-8.amzn2.0.5 | ALAS2-2024-2693 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apache-nifi +2 | 2.0.0-r0 | — |
| Wolfi rolling | celeborn-0.6 | 0.6.3-r7 | — |
| Wolfi rolling | confluent-kafka | 8.0.0.6-r0 | — |
| Wolfi rolling | druid | 37.0.0-r8 | — |
| Wolfi rolling | kserve-modelmesh +1 | 0.12.0-r13 | — |
| Wolfi rolling | kube-fluentd-operator +3 | 1.18.2-r33 | — |
| Wolfi rolling | opensearch-2 | 2.18.0-r0 | — |
| Wolfi rolling | sonarqube-10 | 25.1.0.102122-r0 | — |
| Wolfi rolling | tez | 0.10.4-r6 | — |
| Wolfi rolling | thingsboard +4 | 3.9.1-r2 | — |
| Wolfi rolling | trino +58 | 464-r0 | — |
| Wolfi rolling | wavefront-proxy +3 | 13.7-r5 | — |
Affected packages
Advisories 41
- WID-SEC-2025-0813 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- WID-SEC-2025-0135 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- WID-SEC-2024-3147 Red Hat Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- RHSA-2026:4917 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4916 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4915 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:20052 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-2460 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2026
- WID-SEC-2025-1559 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2025-0823 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2025-0148 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2024-3195 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-7629-2 protobuf vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7629-1 protobuf vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-7435-1 protobuf vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- SUSE-SU-2025:20074-1 Security update for protobuf SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20672-1 Security update for protobuf SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2024:3746-1 Security update for protobuf SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14832-1 libprotobuf-lite28_3_0-28.3-15.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3747-1 Security update for protobuf SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3745-1 Security update for protobuf SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0400 Atlassian Bamboo/Jira : Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Dec 11, 2025
- WID-SEC-2025-2360 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- NCSC-2025-0335 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Oct 23, 2025
- NCSC-2025-0330 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Oct 23, 2025
- WID-SEC-2025-1555 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- WID-SEC-2025-1562 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- NCSC-2025-0132 Kwetsbaarheden verholpen in Oracle MySQL NCSC-NL (Netherlands) · Apr 16, 2025
- NCSC-2025-0128 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Apr 16, 2025
- NCSC-2025-0124 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Apr 16, 2025
- WID-SEC-2025-0824 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- WID-SEC-2025-0822 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- WID-SEC-2025-0818 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- WID-SEC-2025-0474 IBM Business Automation Workflow: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Mar 3, 2025
- WID-SEC-2024-3210 IBM WebSphere Application Server: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Feb 27, 2025
- NCSC-2025-0028 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Jan 22, 2025
- NCSC-2025-0021 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jan 22, 2025
- NCSC-2025-0020 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Jan 22, 2025
- ALAS2-2024-2693 Important: protobuf security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 15, 2024
- WID-SEC-2024-3346 IBM App Connect Enterprise: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 5, 2024
- NCSC-2024-0414 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 17, 2024