Rocky Linux 9.2 [CIQ] Security Update: protobuf / protobuf-compiler / protobuf-devel / protobuf-lite / etc (ciqsa-2026_1628)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261628 advisory. This advisory aggregates security fixes for the protobuf SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2021-22570. Tenable has extracted the preceding description...

OPENSUSE-SU-2026:10515-1 libprotobuf-lite34_1_0-32bit-34.1-1.1 on GA media

These are all security issues fixed in the libprotobuf-lite3410-32bit-34.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15265-1 libprotobuf-lite31_1_0-31.1-1.1 on GA media

These are all security issues fixed in the libprotobuf-lite3110-31.1-1.1 package on the GA media of openSUSE Tumbleweed...

OESA-2025-1144 protobuf security update

Protocol Buffers a.k.a., protobuf are Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data. You can find protobuf's documentation on the Google Developers site. Security Fixes: Any project that parses untrusted Protocol Buffers data containing an...

Atlassian Jira Service Management Data Center and Server 5.4.x < 5.4.27, 5.12.x < 5.12.14 / 5.13.x < 5.17.4 / 10.0.x < 10.1.1 (JSDSERVER-15617)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-15617 advisory. - Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested...

GHSA-735F-PC8J-V9W8 protobuf-java has potential Denial of Service issue

Summary When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash. Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team Affected versions: This issue affects all versions of both t...

DEBIAN-CVE-2024-7254

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or...

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow via the parsing of nested groups or series of SGROUP tags as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields. An attacker can cause infinite recursi...

CVE-2024-7254

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or...

CVE-2024-7254

CVE-2024-7254 describes a stack overflow DoS in parsers when handling untrusted Protocol Buffers data with deeply nested SGROUP/group structures. The root cause is unbounded recursion when parsing unknown fields (DiscardUnknownFieldsParser) or Java Protobuf Lite against nested groups or map field...

CVE-2024-7254

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or...

CVE-2024-7254: Uncontrolled Resource Consumption

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or...

com.google.ambient.crossdevice:crossdevice (0.1.0-preview01), com.google.protobuf:protobuf-kotlin-lite (>=3.21.0, <=3.21.6) +12 more potentially affected by CVE-2022-3510 via com.google.protobuf:protobuf-javalite (>=3.21.0, <=3.21.6)

com.google.protobuf:protobuf-javalite MAVEN version =3.21.0, =3.21.0, =2.15.0, =2.15.0, =0.4.6, =0.4.6, =0.4.6, =0.4.6, =7.3.0, =7.3.0, =0.3.1, =0.3.5, =1.48.0, =1.49.1 Source cves: CVE-2022-3510 Source advisory: OSV:GHSA-4GG5-VX3J-XWC7...

com.google.ambient.crossdevice:crossdevice (0.1.0-preview01), com.google.protobuf:protobuf-kotlin-lite (>=3.21.0-rc-1, <=3.21.6) +12 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-javalite (>=3.21.0-rc-1, <=3.21.6)

com.google.protobuf:protobuf-javalite MAVEN version =3.21.0-rc-1, =3.21.0-rc-1, =2.15.0, =2.15.0, =0.4.6, =0.4.6, =0.4.6, =0.4.6, =7.3.0, =7.3.0, =0.3.1, =0.3.5, =1.48.0, =1.49.1 Source cves: CVE-2022-3171 Source advisory: MEND:CVE-2022-3171...