Security update for protobuf

🗓️ 29 Apr 2026 00:46:40Reported by SuseType

suse🔗 www.suse.com👁 6 Views

Security update for protobuf fixes crash from untrusted data and recursion bypass in nested Any messages.

Reporter	Title	Published	Views	Family All 329
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses protobuf-4.25.3-cp37-abi3-manylinux2014_x86_64.whl, protobuf-6.33.4-cp39-abi3-manylinux2014_x86_64.whl which is vulnerable to CVE-2026-0994	29 May 202608:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities	29 Jul 202607:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security vulnerabilities affecting IBM Knowledge Catalog Premium Cartridge	7 Apr 202620:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses protobuf-4.21.12-cp37-abi3-manylinux2014_x86_64.whl and protobuf-4.25.7-cp37-abi3-manylinux2014_x86_64.whl which is vulnerable to CVE-2025-4565	29 May 202608:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	28 Aug 202507:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring and Dashboard operands are vulnerable to denial of service (CVE-2026-0994)	15 Apr 202609:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in protobuf	29 Oct 202510:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups.	29 Jul 202519:10	–	ibm
IBM Security Bulletins	Security Bulletin: The Network Threat Analytics App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	24 Jun 202614:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.	19 Jun 202610:42	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
suse	15	aarch64	libprotobuf-lite20	3.9.2	libprotobuf-lite20-3.9.2-150200.4.33.1.aarch64.rpm
suse	15	aarch64	libprotobuf-lite20-debuginfo	3.9.2	libprotobuf-lite20-debuginfo-3.9.2-150200.4.33.1.aarch64.rpm
suse	15	aarch64	libprotobuf20	3.9.2	libprotobuf20-3.9.2-150200.4.33.1.aarch64.rpm
suse	15	aarch64	libprotobuf20-debuginfo	3.9.2	libprotobuf20-debuginfo-3.9.2-150200.4.33.1.aarch64.rpm
suse	15	aarch64	libprotoc20	3.9.2	libprotoc20-3.9.2-150200.4.33.1.aarch64.rpm
suse	15	aarch64	libprotoc20-debuginfo	3.9.2	libprotoc20-debuginfo-3.9.2-150200.4.33.1.aarch64.rpm
suse	15	aarch64	protobuf-debugsource	3.9.2	protobuf-debugsource-3.9.2-150200.4.33.1.aarch64.rpm
suse	15	ppc64le	libprotobuf-lite20	3.9.2	libprotobuf-lite20-3.9.2-150200.4.33.1.ppc64le.rpm
suse	15	ppc64le	libprotobuf-lite20-debuginfo	3.9.2	libprotobuf-lite20-debuginfo-3.9.2-150200.4.33.1.ppc64le.rpm
suse	15	ppc64le	libprotobuf20	3.9.2	libprotobuf20-3.9.2-150200.4.33.1.ppc64le.rpm

Source	Link
bugzilla	www.bugzilla.suse.com/show_bug.cgi
bugzilla	www.bugzilla.suse.com/show_bug.cgi
bugzilla	www.bugzilla.suse.com/show_bug.cgi
suse	www.suse.com/security/cve/CVE-2025-4565.html
suse	www.suse.com/security/cve/CVE-2026-0994.html
suse	www.suse.com/security/cve/CVE-2025-4565.html
suse	www.suse.com/security/cve/CVE-2026-0994.html
bugzilla	www.bugzilla.suse.com/show_bug.cgi
bugzilla	www.bugzilla.suse.com/show_bug.cgi
bugzilla	www.bugzilla.suse.com/show_bug.cgi

29 Apr 2026 00:46Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.15.9

CVSS 48.2

EPSS0.00688

protobuf recursion_crash any_messages nested_messages recursion_bypass security_update