Skip to content

protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl: 3 vulnerabilities (highest severity is: 8.6) [master] (unreachable) #45

Open
Open
protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl: 3 vulnerabilities (highest severity is: 8.6) [master] (unreachable)#45

Description

@renovate
renovate
bot
opened on May 7, 2026
📂 Vulnerable Library - protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl

No project description provided

Library home page: https://files.pythonhosted.org/packages/5c/a6/9a451d69492a695e2300643933590762aa4e5bbef2ae5f08f7d218ea6c3a/protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260720225829_XICAJU/python_DRWLIV/202607202258321/env/lib/python3.10/site-packages/protobuf-3.20.0.dist-info

Findings

Finding Severity 🎯 CVSS Exploit Maturity EPSS Library Type Fixed in Remediation Available Reachability
CVE-2026-0994 🔴 High 8.6 Not Defined < 1% protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl Direct protobuf - 6.33.5,https://github.com/protocolbuffers/protobuf.git - v33.5,https://github.com/protocolbuffers/protobuf.git - v29.6,https://github.com/protocolbuffers/protobuf.git - v3.29.6-objectivec,https://github.com/protocolbuffers/protobuf.git - v5.29.6-cpp,https://github.com/protocolbuffers/protobuf.git - v5.35.0-objectivec,https://github.com/protocolbuffers/protobuf.git - v4.33.5-objectivec,protobuf - 6.33.5 ✅ Unreachable
CVE-2022-1941 🔴 High 7.5 Not Defined 1.181% protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl Direct protobuf-cpp - 3.18.3,3.19.5,3.20.2,3.21.6;protobuf-python - 3.18.3,3.19.5,3.20.2,4.21.6 ✅ Unreachable
CVE-2025-4565 🔴 High 7.5 Not Defined < 1% protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl Direct protobuf - 4.25.8,protobuf - 5.29.5,protobuf - 6.31.1,protobuf - 4.25.8,protobuf - 5.29.5,https://github.com/protocolbuffers/protobuf.git - 4.25.8,https://github.com/protocolbuffers/protobuf.git - v6.31.1,https://github.com/protocolbuffers/protobuf.git - v5.29.5 ✅ Unreachable

Details

🔴CVE-2026-0994

Vulnerable Library - protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl

No project description provided

Library home page: https://files.pythonhosted.org/packages/5c/a6/9a451d69492a695e2300643933590762aa4e5bbef2ae5f08f7d218ea6c3a/protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260720225829_XICAJU/python_DRWLIV/202607202258321/env/lib/python3.10/site-packages/protobuf-3.20.0.dist-info

Dependency Hierarchy:

  • ❌ protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.
Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

Publish Date: Jan 23, 2026 02:55 PM

URL: CVE-2026-0994

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.6

Suggested Fix

Type: Upgrade version

Origin: protocolbuffers/protobuf@d2b0016

Release Date: Jan 23, 2026 02:55 PM

Fix Resolution : protobuf - 6.33.5,https://github.com/protocolbuffers/protobuf.git - v33.5,https://github.com/protocolbuffers/protobuf.git - v29.6,https://github.com/protocolbuffers/protobuf.git - v3.29.6-objectivec,https://github.com/protocolbuffers/protobuf.git - v5.29.6-cpp,https://github.com/protocolbuffers/protobuf.git - v5.35.0-objectivec,https://github.com/protocolbuffers/protobuf.git - v4.33.5-objectivec,protobuf - 6.33.5

🔴CVE-2022-1941

Vulnerable Library - protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl

No project description provided

Library home page: https://files.pythonhosted.org/packages/5c/a6/9a451d69492a695e2300643933590762aa4e5bbef2ae5f08f7d218ea6c3a/protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260720225829_XICAJU/python_DRWLIV/202607202258321/env/lib/python3.10/site-packages/protobuf-3.20.0.dist-info

Dependency Hierarchy:

  • ❌ protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.

Publish Date: Sep 22, 2022 12:00 AM

URL: CVE-2022-1941

Threat Assessment

Exploit Maturity:Not Defined

EPSS:1.181%

Score: 7.5

Suggested Fix

Type: Upgrade version

Origin: GHSA-8gq9-2x98-w8hf

Release Date: Sep 22, 2022 12:00 AM

Fix Resolution : protobuf-cpp - 3.18.3,3.19.5,3.20.2,3.21.6;protobuf-python - 3.18.3,3.19.5,3.20.2,4.21.6

🔴CVE-2025-4565

Vulnerable Library - protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl

No project description provided

Library home page: https://files.pythonhosted.org/packages/5c/a6/9a451d69492a695e2300643933590762aa4e5bbef2ae5f08f7d218ea6c3a/protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260720225829_XICAJU/python_DRWLIV/202607202258321/env/lib/python3.10/site-packages/protobuf-3.20.0.dist-info

Dependency Hierarchy:

  • ❌ protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901

Publish Date: Jun 16, 2025 02:50 PM

URL: CVE-2025-4565

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 7.5

Suggested Fix

Type: Upgrade version

Origin: GHSA-8qvm-5x2c-j2w7

Release Date: Jun 16, 2025 02:50 PM

Fix Resolution : protobuf - 4.25.8,protobuf - 5.29.5,protobuf - 6.31.1,protobuf - 4.25.8,protobuf - 5.29.5,https://github.com/protocolbuffers/protobuf.git - 4.25.8,https://github.com/protocolbuffers/protobuf.git - v6.31.1,https://github.com/protocolbuffers/protobuf.git - v5.29.5

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions