CVE-2021-21401: Nanopb Project Nanopb

High severity, CVSS 7.1. EPSS: 1.8% chance of exploitation in the next 30 days.

Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `oneof` directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field is incorrectly treated as if it was a pointer value. Such message data rarely occurs in normal messages, but it is a concern when untrusted data is parsed. This has been fixed in versions 0.3.9.8 and 0.4.5. See referenced GitHub Security Advisory for more information including workarounds.

Affected products

• Nanopb Project Nanopb: before 0.3.9.8 (fixed in 0.3.9.8); from 0.4.0, before 0.4.5 (fixed in 0.4.5)

Published 2021-03-23. Last modified 2026-06-17.