Google Protobuf-Python vulnerabilities

2 CVEs affecting Google Protobuf-Python, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-4565, published 2025-06-16.

More from Google.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-1941, published 2022-09-22. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and…
• CVE-2025-4565, published 2025-06-16. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be…