Protobuf (Google) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 407 known versions, newest CVE from 2026-01-23. Vendor: Google.

CVEs of Protobuf

• CVE-2026-0994 - CVSS 8.2 (high), 2026-01-23: A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when…
• CVE-2024-7254 - CVSS 8.7 (high), 2024-09-19: Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the…
• CVE-2024-2410 - CVSS 9.8 (critical), 2024-05-03: The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream. If the input is broken up into…
• CVE-2021-22570 - CVSS 6.5 (medium), 2022-01-26: Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name…
• CVE-2015-5237 - CVSS 8.8 (high), 2017-09-25: protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.