Google Protobuf vulnerabilities

5 CVEs affecting Google Protobuf, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-0994, published 2026-01-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-5237, published 2017-09-25. High severity, CVSS 8.8. EPSS: 5% chance of exploitation in the next 30 days. protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
CVE-2024-7254, published 2024-09-19. High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days. Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing…
CVE-2021-22570, published 2022-01-26. Medium severity, CVSS 5.5. EPSS: 2.7% chance of exploitation in the next 30 days. Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error…
CVE-2026-0994, published 2026-01-23. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any…
CVE-2024-2410, published 2024-05-03. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream. If the input is broken up into separate chunks in a certain way, the…