protobuf vulnerabilities

2 known vulnerabilities in protobuf from Google. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Protocol Buffers: Out-of-bounds Write

  CVE-2024-7254Sep 19, 2024GoogleEPSS 2.77%

  Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsPars

• 9.8 Critical severity

  protobuf: Use After Free

  CVE-2024-2410May 3, 2024Protocolbuffers

  The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream. If the input is broken up into separate chunks in a certain way, the parser will attempt to read bytes from a chunk that has already b