# protobuf (PyPI) vulnerabilities

5 known vulnerabilities (3 high, 1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Weekly downloads: 178.6M
- Dependents: 40.7K
- Registry: https://pypi.org/project/protobuf/

## Advisories (5)

### [CVE-2026-0994](https://cve.now/CVE-2026-0994): Denial of Service in Python Protobuf

- Severity: High 8.2
- Published: Jan 23, 2026
- Affected: from 6.30.0rc1, fixed in 6.33.5; fixed in 5.29.6; fixed in 5.29.6; from 6.30.0rc1, fixed in 6.33.5.

### [CVE-2025-4565](https://cve.now/CVE-2025-4565): Unbounded recursion in Python Protobuf

- Severity: High 8.2
- Published: Jun 16, 2025
- Affected: fixed in 4.25.8; from 5.26.0rc1, fixed in 5.29.5; from 6.30.0rc1, fixed in 6.31.1; fixed in 4.25.8; from 5.26.0rc1, fixed in 5.29.5; from 6.30.0rc1, fixed in 6.31.1.

### [CVE-2022-1941](https://cve.now/CVE-2022-1941): Out of Memory issue in ProtocolBuffers for cpp and python

- Severity: High 7.5
- Published: Sep 22, 2022
- Affected: fixed in 3.18.3; from 3.19.0, fixed in 3.19.5; from 3.20.0, fixed in 3.20.2; from 4.0.0, fixed in 4.21.6; fixed in 3.18.3; from 3.19.0, fixed in 3.19.5; from 3.20.0, fixed in 3.20.2; from 4.0.0, fixed in 4.21.6.

### [CVE-2021-22570](https://cve.now/CVE-2021-22570): Nullptr Dereference in Protobuf

- Severity: Medium 6.5
- Published: Jan 26, 2022
- Affected: fixed in 3.15.0.

### [CVE-2015-5237](https://cve.now/CVE-2015-5237): protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

- Severity: Unrated
- Published: Sep 25, 2017
- Affected: fixed in 3.4.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/protobuf
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.