boringssl

BoringSSL BoringSSL is a fork of OpenSSL that is designed to meet Google's needs. Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no...

CVE-2021-21401_nanopb-c_AOSP10_R33

Nanopb - Protocol Buffers para Sistemas Embebidos ============================================== Nanopb es una implementación de Protocol Buffers de tamaño de código reducido en C ANSI. Es especialmente adecuado para su uso en microcontroladores, pero se adapta a cualquier sistema con restriccion...

EUVD-2026-44949

Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref...

CLSA-2026-1785468077 TuxCare security update for protobufjs (7 CVEs)

TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 5.0.0-tuxcare.2...

CVE-2026-67198 Perspective 5.0.0 DoS via VirtualServer Protocol Dispatcher

Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with ...

CVE-2026-67195

CVE-2026-67195 describes a remote code execution in Perspective 5.0.0 via an eval() expression injection in the PolarsVirtualServer backend. The vulnerability occurs when client-supplied input is passed directly to Python’s eval() with almost no sandboxing (builtins cleared). Attackers can traver...

CVE-2026-45799

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup and ProtoReader.skipGroup in wire-runtime do not validate that a LENGTHDELIMITED field length is non-negative before skip, allowing a crafted protobuf...

UBUNTU-CVE-2026-45799

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup and ProtoReader.skipGroup in wire-runtime do not validate that a LENGTHDELIMITED field length is non-negative before skip, allowing a crafted protobuf...

CVE-2026-55406

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to &'static u8, and the Deref...

CVE-2026-55407 Buffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decodeunknownfield function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input unknown fields in the serialized protobuf without enforcing an...

CVE-2026-55407

CVE-2026-55407 affects Buffa, a pure-Rust Protocol Buffers implementation. Before v0.8.0, decode_unknown_field could allocate unbounded heap in response to untrusted input, causing memory amplification (e.g., a 64 MiB input could trigger ~1.4 GB). This impacts messages decoded with preserve_unkno...

PT-2026-60502

Name of the Vulnerable Software and Affected Versions Buffa versions prior to 0.7.0 Description A soundness bug in the OwnedView type allows safe Rust code to trigger a use-after-free. The OwnedView::decode constructor transmutes a borrowed slice to &'static u8, and the Deref implementation expos...

PYSEC-2026-3139 Reachable Assertion in Tensorflow

Impact When decoding a resource handle tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments. This allows attackers to cause denial of services in TensorFlow processes. Patches We have patched the issue in GitHub...

Infinite loop

Overview protobufjs is a protocol buffer for JavaScript & TypeScript. Affected versions of this package are vulnerable to Infinite loop in the option parsing. An attacker can cause the application to enter an infinite loop by submitting a crafted .proto schema that opens an option declaration and...

PT-2026-56497

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.6.5 protobufjs versions prior to 8.6.6 Description protobufjs compiles protobuf definitions into JavaScript functions. The software parses option names by advancing through schema tokens until an = token is reach...

PYSEC-2026-899 protobuf-cpp and protobuf-python have potential Denial of Service issue

Summary A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory OOM failure when processing a specially crafted message, which could lead to a denial of service DoS on services using the libraries. Reporter: ClusterFuzz...

The vulnerability of the decoder in the UTF-8 library for working with the Protocol Buffers protocol (Protobuf) protobufjs allows attackers to bypass existing security mechanisms.

The vulnerability of the UTF-8 decoder in the Protocol Buffers Protobuf protobufjs library is related to incorrect handling of Unicode characters. Exploiting this vulnerability can allow a malicious actor to bypass existing security mechanisms remotely...

The vulnerability of the library for working with the Protocol Buffers protocol protobufjs, related to uncontrolled changes to object prototype attributes, allows a hacker to trigger a service failure.

The vulnerability of the library for working with the Protocol Buffers protocol Protobuf protobufjs is related to uncontrolled changes to object prototype attributes. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the decoder in the Protocol Buffers library allows a attacker to cause a service failure.

The vulnerability of the decoder in the Protocol Buffers-based library related to Protocol Buffers Protobuf protobufjs is associated with an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the library for working with the Protocol Buffers protocol (Protobuf) protobufjs lies in the uncontrolled modification of object prototype attributes, allowing attackers to increase their privileges.

The vulnerability of the library for working with the Protocol Buffers protocol Protobuf protobufjs is related to uncontrolled changes to object prototype attributes. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...