PatchTheCVEprotobuf vulnerabilities and fixes
Recent CVEs affecting protobuf, with upgrade or downgrade steps. 4 tracked.
protobuf has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-01-23. Highest priority: CVE-2024-7254 (score 53/100).
- CVE-2026-0994 HIGH 7.5 UPGRADE A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the
- CVE-2024-7254 HIGH 7.5 UPGRADE UPGRADE Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / seri
- CVE-2024-2410 HIGH 7.6 UPGRADE The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON
- CVE-2023-24535 HIGH 7.5 DOWNGRADE Parsing invalid messages can panic
FAQ
How do I fix protobuf vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is protobuf being exploited right now?
None of the tracked protobuf CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which protobuf CVE should I patch first?
CVE-2024-7254 currently ranks highest (53/100): Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / seri.