2084 matches found
CVE-2026-85201
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO . A workload with Control Interface access can specify an excessive message length, triggering an unbounde...
EUVD-2026-72341
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded...
PT-2026-86676
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded...
CVE-2026-85201: Memory Allocation with Excessive Size Value
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded...
CVE-2026-84700
PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...
CVE-2026-84700 Pika Unauthenticated Replication Access via Internal Protobuf Port
PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...
CVE-2026-84700
PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g., 11221 for the default 9221) that lacks authentication for non-MetaSync messages. The root cause is that the frame dispatcher (DealMessage ) does not require a completed o...
CVE-2026-84700 Pika Unauthenticated Replication Access via Internal Protobuf Port
PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...
EUVD-2026-69791
PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...
CVE-2026-84700 Pika Unauthenticated Replication Access via Internal Protobuf Port
PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...
PT-2026-84579
PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...
CVE-2026-84700: Missing Authentication for Critical Function
PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...
GHSA-F9QC-QG88-7PQ5 Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
The decodeunknownfield function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input unknown fields in the serialized protobuf without enforcing an allocation budget. Any message decoded from untrusted input using code generated with preserveunknownfields=true the...
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
The decodeunknownfield function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input unknown fields in the serialized protobuf without enforcing an allocation budget. Any message decoded from untrusted input using code generated with preserveunknownfields=true the...
CLSA-2026-1787916992 TuxCare security update for google/protobuf (1 CVE)
TuxCare rebuilt google/protobuf to address 1 CVE. Fixed in 3.25.9-p1+tuxcare...
PT-2026-86885
TuxCare rebuilt google/protobuf to address 1 CVE. Fixed in 3.25.9-p1+tuxcare...
EUVD-2026-37013
gRPC Erlang package's path bindings are overridable by query string and request body...
PT-2026-93890
Name of the Vulnerable Software and Affected Versions Wire versions prior to 6.4.5 Wire versions prior to 7.0.0-alpha04 Description An integer overflow exists in the protobuf and gRPC decoder. Protobuf readers fail to consistently validate attacker-controlled lengths against the logical message...
pbtk v1.1.3
pbtk - Reverse engineering Protobuf apps Protobuf is a serialization format developed by Google and used in an increasing number of Android, web, desktop and more applications. It consists of a language for declaring data structures , which is then compiled to code or another kind of structure...
