---
id: CVE-2022-1941
title: 'protobuf: message parsing vulnerability in ProtocolBuffers (CVE-2022-1941)'
summary: >-
  A parsing vulnerability for the MessageSet type in the ProtocolBuffers can
  lead to out of memory failures. A specially crafted message with multiple
  key-value per elements creates parsing issues, and can lead to a Denial of
  Service against…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-1286
vendor: Red Hat
product: Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
affected:
  - enterprise_linux_appstream_v_9
  - enterprise_linux_codeready_linux_builder_v_9
patched:
  - enterprise_linux_appstream_v_9
  - enterprise_linux_codeready_linux_builder_v_9
published: '2022-09-22'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:19:12+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-1941.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-1941.json
  - url: 'https://access.redhat.com/security/cve/CVE-2022-1941'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2291470'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2022-1941'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-1941'
  - url: 'http://www.openwall.com/lists/oss-security/2022/09/27/1'
  - url: 'https://cloud.google.com/support/bulletins#GCP-2022-019'
  - url: >-
      https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8gq9-2x98-w8hf
  - url: 'https://access.redhat.com/errata/RHSA-2025:7138'
  - url: 'https://github.com/protocolbuffers/protobuf'
  - url: 'https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP
  - url: 'https://security.netapp.com/advisory/ntap-20240705-0001'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.01512
epssPercentile: 0.7433
aliases:
  - GHSA-8gq9-2x98-w8hf
  - PYSEC-2026-899
ecosystem: pip
scores:
  vendor: 6.5
  osv: 7.5
ingestedAt: '2026-07-08T18:25:47.490Z'
---

## Overview

A parsing vulnerability for the MessageSet type in the ProtocolBuffers can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input.

## Vendor advisories

- **RHSA-2025:7138** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:7138)

**protobuf: message parsing vulnerability in ProtocolBuffers** — rated Moderate by Red Hat. Released 2022-09-22, updated 2026-10-16.

Fixed:

- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)

Not affected:

- Red Hat 3scale API Management Platform 2
- Red Hat Ansible Automation Platform 2
- Red Hat Ceph Storage 7
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2

## Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:7138

## Package advisory (CVE-2022-1941)

Affected packages:

- `protobuf < 3.18.3`
- `protobuf >= 3.19.0, < 3.19.5`
- `protobuf >= 3.20.0, < 3.20.2`
- `protobuf >= 4.0.0, < 4.21.6`

Patched in:

- `protobuf 3.18.3`
- `protobuf 3.19.5`
- `protobuf 3.20.2`
- `protobuf 4.21.6`

Source: https://osv.dev/vulnerability/GHSA-8gq9-2x98-w8hf