Vulnerabilities for protobuf

First version without a known vulnerability: 7.34.0rc1

Details

• GHSA-7gcm-g887-7qv72026-01-23

  protobuf affected by a JSON recursion depth bypass

  Fixed in: 6.33.5, 5.29.6

• GHSA-8qvm-5x2c-j2w72025-06-16

  protobuf-python has a potential Denial of Service issue

  Fixed in: 4.25.8, 5.29.5, 6.31.1

• GHSA-8gq9-2x98-w8hf2022-09-23

  protobuf-cpp and protobuf-python have potential Denial of Service issue

  Fixed in: 3.18.3, 3.19.5, 3.20.2, 4.21.6

• GHSA-jwvw-v7c5-m82h2022-05-13

  protobuf susceptible to buffer overflow

  Fixed in: 3.4.0

• PYSEC-2022-482022-01-26

  Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

  Fixed in: 3.15.0