2084 matches found
CVE-2026-55407: Uncontrolled Resource Consumption
Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decodeunknownfield function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input unknown fields in the serialized protobuf without enforcing an...
CVE-2026-54451
creationtimestamp| type| source ---|---|--- 2026-07-15 18:35:03+00:00| published-proof-of-concept| https://github.com/elixir-protobuf/protobuf/security/advisories/GHSA-rv48-qqj5-crxg...
Protobuf: Unbounded recursion depth in embedded-message decoding
Summary Unbounded recursion depth in Protobuf.Decoder Hex package protobuf, versions = 0.8.0, 0.16.1 lets an unauthenticated attacker crash any service that decodes untrusted protobuf messages whose schema contains a self-referential or cyclic message type. A small request body a few KB to a few ...
PT-2026-60375
Name of the Vulnerable Software and Affected Versions Elixir protobuf versions 0.8.0 through 0.16.0 Description Services using Protobuf.Decoder to decode attacker-controlled bytes can be taken offline if the schema contains a self-referential or cyclic message type. The Protobuf.Decoder.value for...
PYSEC-2026-3153 Null-dereference in Tensorflow
Impact When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a DCHECK: cc const auto attr = attrs.Findarg-s; DCHECKattr != nullptr; if attr-valuecase == AttrValue::kLis...
Null-dereference in Tensorflow
ImpactWhen decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a DCHECK:cc const auto attr = attrs.Findarg-s; DCHECKattr != nullptr; if attr-valuecase == AttrValue::kList ...
PYSEC-2026-3204 Reachable Assertion in Tensorflow
Impact When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments, if the tensors have an invalid dtype and 0 elements or an invalid shape. This allows attackers to cause denial of services in TensorFlow...
Reachable Assertion in Tensorflow
ImpactWhen decoding a tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments, if the tensors have an invalid dtype and 0 elements or an invalid shape. This allows attackers to cause denial of services in TensorFlow...
protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors
A flaw was found in protobufjs, a library used to compile protobuf definitions into JavaScript functions. A remote attacker could exploit this vulnerability by providing a crafted descriptor that includes a non-string default value for a bytes field. This could lead to the generation of an unsafe...
PT-2026-59821
Impact When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments, if the tensors have an invalid dtype and 0 elements or an invalid shape. This allows attackers to cause denial of services in TensorFlow...
PT-2026-59770
Impact When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a DCHECK: cc const auto attr = attrs.Findarg-s; DCHECKattr != nullptr; if attr-value case == AttrValue::kLi...
PT-2026-59756
Impact When decoding a resource handle tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments. This allows attackers to cause denial of services in TensorFlow processes. Patches We have patched the issue in GitHub...
Exploit for Uncontrolled Resource Consumption in Google Protobuf
No d...
PYSEC-2026-1805 protobuf affected by a JSON recursion depth bypass
A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can...
galaxy-ng (>=4.6.0, <=4.6.6), pulp-rpm (>=3.17.6, <=3.17.22) +1 more potentially affected by CVE-2026-0994 via protobuf (4.22.0rc3)
protobuf PYPI version 4.22.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - galaxy-ng =4.6.0, =3.17.6, =3.21.0, =3.21.36 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...
admobilizeapis (>=0.0.5, <=0.0.7), c3-reference (1.8.1) +8 more potentially affected by CVE-2026-0994 via protobuf (3.6.0)
protobuf PYPI version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - admobilizeapis =0.0.5, =1.1.4, =1.0.5, =1.9.1, =1.10.0 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...
ac-solver (0.1.0), aioradio (>=0.20.23, <=0.21.1) +19 more potentially affected by CVE-2026-0994 via protobuf (4.25.4)
protobuf PYPI version 4.25.4 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - ac-solver 0.1.0 - aioradio =0.20.23, =1.0.0, =0.1.3, =0.3.3, =1.2.1, =3.2.0.9, =0.0.23, =0.1.5, =0.14.0, =0.1.0, =0.1.2 - rknn-toolkit2-compat...
asc (>=0.1.0, <=0.3.1), candig-ingest (>=1.3.1, <=1.5.0) +6 more potentially affected by CVE-2026-0994 via protobuf (3.3.0)
protobuf PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - asc =0.1.0, =1.3.1, =1.0.1, =1.2.3, =2018.1.0, =0.0.0.dev1, =0.0.0.dev37 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...
apollo-sdk (>=0.1.1, <=0.2.11), candy-web (1.0.0) +80 more potentially affected by CVE-2026-0994 via protobuf (4.22.3)
protobuf PYPI version 4.22.3 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - apollo-sdk =0.1.1, =0.1.0, =0.3.0, =0.104.3rc1, =0.9.0rc1, =23.0.0, =0.0.1.dev5, =0.0.1.dev14 and more Source cves: CVE-2026-0994 Source...
ak-gpapi (>=3.0.4, <=3.0.8), angorapy (>=0.8.0, <=0.8.1) +27 more potentially affected by CVE-2026-0994 via protobuf (3.19.0)
protobuf PYPI version 3.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - ak-gpapi =3.0.4, =0.8.0, =0.1.0, =1.0.1, =0.0.6, =0.6.5, =0.0.1, =1.1.0, =1.1.0, =0.0.4, =0.2.1 and more Source cves: CVE-2026-0994 Source...