{"id":"CVE-2022-1941","title":"protobuf: message parsing vulnerability in ProtocolBuffers (CVE-2022-1941)","summary":"A parsing vulnerability for the MessageSet type in the ProtocolBuffers can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-1286","vendor":"Red Hat","product":"Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)","affected":["enterprise_linux_appstream_v_9","enterprise_linux_codeready_linux_builder_v_9"],"patched":["enterprise_linux_appstream_v_9","enterprise_linux_codeready_linux_builder_v_9"],"published":"2022-09-22","updated":"2026-10-16","sourceUpdated":"2026-10-16T17:19:12+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-1941.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-1941.json"},{"url":"https://access.redhat.com/security/cve/CVE-2022-1941"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2291470"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1941"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1941"},{"url":"http://www.openwall.com/lists/oss-security/2022/09/27/1"},{"url":"https://cloud.google.com/support/bulletins#GCP-2022-019"},{"url":"https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8gq9-2x98-w8hf"},{"url":"https://access.redhat.com/errata/RHSA-2025:7138"},{"url":"https://github.com/protocolbuffers/protobuf"},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP"},{"url":"https://security.netapp.com/advisory/ntap-20240705-0001"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.01512,"epssPercentile":0.7433,"aliases":["GHSA-8gq9-2x98-w8hf","PYSEC-2026-899"],"ecosystem":"pip","scores":{"vendor":6.5,"osv":7.5},"ingestedAt":"2026-07-08T18:25:47.490Z","slug":"CVE-2022-1941","body":"## Overview\n\nA parsing vulnerability for the MessageSet type in the ProtocolBuffers can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input.\n\n## Vendor advisories\n\n- **RHSA-2025:7138** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:7138)\n\n**protobuf: message parsing vulnerability in ProtocolBuffers** — rated Moderate by Red Hat. Released 2022-09-22, updated 2026-10-16.\n\nFixed:\n\n- Red Hat Enterprise Linux AppStream (v. 9)\n- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\n\nNot affected:\n\n- Red Hat 3scale API Management Platform 2\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 7\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenStack Platform 16.1\n- Red Hat OpenStack Platform 16.2\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:7138\n\n## Package advisory (CVE-2022-1941)\n\nAffected packages:\n\n- `protobuf < 3.18.3`\n- `protobuf >= 3.19.0, < 3.19.5`\n- `protobuf >= 3.20.0, < 3.20.2`\n- `protobuf >= 4.0.0, < 4.21.6`\n\nPatched in:\n\n- `protobuf 3.18.3`\n- `protobuf 3.19.5`\n- `protobuf 3.20.2`\n- `protobuf 4.21.6`\n\nSource: https://osv.dev/vulnerability/GHSA-8gq9-2x98-w8hf","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[{"seq":220017,"id":"CVE-2022-1941","ts":1791978481382,"field":"cvss","old":"7.5","new":"6.5"},{"seq":220016,"id":"CVE-2022-1941","ts":1791978481382,"field":"severity","old":"high","new":"medium"}]}