CVE catalog

CVE-2021-22570

protobuf affected and fixed versions

[CVE catalog]

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.66% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixieprotobuf3.21.12-11+deb13u1Fixed[CVE-2021-22570]
Debiantrixieprotobuf3.21.9-3FixedDistribution-reported fixed boundary[CVE-2021-22570]
Debiansidprotobuf3.21.12-17Fixed[CVE-2021-22570]
Debiansidprotobuf3.21.9-3FixedDistribution-reported fixed boundary[CVE-2021-22570]
Debianforkyprotobuf3.21.12-17Fixed[CVE-2021-22570]
Debianforkyprotobuf3.21.9-3FixedDistribution-reported fixed boundary[CVE-2021-22570]
Debianbookwormprotobuf3.21.12-3+deb12u1Fixed[CVE-2021-22570]
Debianbookwormprotobuf3.21.9-3FixedDistribution-reported fixed boundary[CVE-2021-22570]

Showing 8 fix observations. All 52 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedprotobuf3.21.9-3UnknownSource applicability is not establishedProvider not reported
Debianbookwormprotobuf3.21.12-3+deb12u1Fixed[CVE-2021-22570]
Debianbookwormprotobuf3.21.9-3FixedDistribution-reported fixed boundary[CVE-2021-22570]
Debianforkyprotobuf3.21.12-17Fixed[CVE-2021-22570]
Debianforkyprotobuf3.21.9-3FixedDistribution-reported fixed boundary[CVE-2021-22570]
Debiansidprotobuf3.21.12-17Fixed[CVE-2021-22570]
Debiansidprotobuf3.21.9-3FixedDistribution-reported fixed boundary[CVE-2021-22570]
Debiantrixieprotobuf3.21.12-11+deb13u1Fixed[CVE-2021-22570]
Debiantrixieprotobuf3.21.9-3FixedDistribution-reported fixed boundary[CVE-2021-22570]
Opensuseleap 15.3protobuf3.5.0-5.5.1UnknownSource applicability is not established[OPENSUSE-SU-2022:0823-1]
Opensuseleap 15.3protobuf3.9.2-4.12.1UnknownSource applicability is not established[OPENSUSE-SU-2022:1040-1]
Suseenterprise storage 7protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-3]
Suselinux enterprise high performance computing 15 sp2-esposprotobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-3]
Suselinux enterprise high performance computing 15 sp2-ltssprotobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-3]
Suselinux enterprise installer updates 15 sp2protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-1]
Suselinux enterprise micro 5.0protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-1]
Suselinux enterprise micro 5.1protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-1]
Suselinux enterprise micro 5.2protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-2]
Suselinux enterprise module for basesystem 15 sp3protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-1]
Suselinux enterprise module for development tools 15 sp3protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-1]
Suselinux enterprise module for package hub 15 sp3protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-1]
Suselinux enterprise module for package hub 15 sp4protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-1]
Suselinux enterprise module for public cloud 15 sp2protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-1]
Suselinux enterprise module for public cloud 15 sp3protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-1]
Suselinux enterprise real time 15 sp2protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-1]
Suselinux enterprise server 15 sp2-bclprotobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-3]
Suselinux enterprise server 15 sp2-ltssprotobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-3]
Suselinux enterprise server for sap applications 15 sp2protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-3]
Susemanager proxy 4.1protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-3]
Susemanager retail branch server 4.1protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-3]
Susemanager server 4.1protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-3]
Susemanager server module 4.1protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-1]
Susemanager server module 4.2protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-1]
Susemanager server module 4.3protobuf3.9.2-4.12.1UnknownSource applicability is not established[SUSE-SU-2022:1040-3]
Ubuntu18.04protobuf3.0.0-9.1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2021-22570]
Ubuntu18.04protobuf3.0.0-9.1ubuntu1.1UnknownSource applicability is not established[UBUNTU-CVE-2021-22570]
Ubuntu18.04protobuf3.0.0-9ubuntu5UnknownSource applicability is not established[UBUNTU-CVE-2021-22570]
Ubuntu18.04protobuf3.0.0-9ubuntu6UnknownSource applicability is not established[UBUNTU-CVE-2021-22570]
Ubuntu20.04protobuf3.6.1.3-2UnknownSource applicability is not established[UBUNTU-CVE-2021-22570]
Ubuntu20.04protobuf3.6.1.3-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2021-22570]
Ubuntu20.04protobuf3.6.1.3-2ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2021-22570]
Ubuntu20.04protobuf3.6.1.3-2ubuntu4UnknownSource applicability is not established[UBUNTU-CVE-2021-22570]
Ubuntu20.04protobuf3.6.1.3-2ubuntu5UnknownSource applicability is not established[UBUNTU-CVE-2021-22570]
Ubuntu20.04protobuf3.6.1.3-2ubuntu5.2UnknownSource applicability is not established[UBUNTU-CVE-2021-22570]
Ubuntu22.04protobuf3.12.4-1ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2021-22570]
Ubuntu22.04protobuf3.12.4-1ubuntu5UnknownSource applicability is not established[UBUNTU-CVE-2021-22570]
Ubuntu22.04protobuf3.12.4-1ubuntu6UnknownSource applicability is not established[UBUNTU-CVE-2021-22570]
Ubuntu22.04protobuf3.12.4-1ubuntu7UnknownSource applicability is not established[UBUNTU-CVE-2021-22570]
Ubuntu22.04protobuf3.12.4-1ubuntu7.22.04.1UnknownSource applicability is not established[UBUNTU-CVE-2021-22570]
Ubuntuproprotobuf2.6.1-1.2UnknownSource applicability is not established[USN-5490-1][UBUNTU-CVE-2021-22570]
Ubuntuproprotobuf2.6.1-1.3UnknownSource applicability is not established[USN-5490-1][UBUNTU-CVE-2021-22570]
Ubuntuproprotobuf2.6.1-1.3ubuntu0.1~esm1UnknownSource applicability is not established[USN-5490-1][UBUNTU-CVE-2021-22570]
Original provider fields
{
  "package_releases": [
    {
      "name": "protobuf",
      "status": "fixed",
      "release": "sid",
      "version": "3.21.12-17"
    },
    {
      "name": "protobuf",
      "status": "fixed",
      "release": "forky",
      "version": "3.21.12-17"
    },
    {
      "name": "protobuf",
      "status": "fixed",
      "release": "trixie",
      "version": "3.21.12-11+deb13u1"
    },
    {
      "name": "protobuf",
      "status": "fixed",
      "release": "bookworm",
      "version": "3.21.12-3+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "protobuf",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "3.21.9-3"
    },
    {
      "bug": null,
      "name": "protobuf",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "3.21.9-3"
    },
    {
      "bug": null,
      "name": "protobuf",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "3.21.9-3"
    },
    {
      "bug": null,
      "name": "protobuf",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "3.21.9-3"
    }
  ],
  "distribution_packages": [
    {
      "name": "protobuf",
      "fixed_version": "3.21.9-3",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.1-1.3ubuntu0.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "2.6.1-1.2",
        "2.6.1-1.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5490-1",
      "fixed_version": "2.6.1-1.3ubuntu0.1~esm1",
      "provider_source": "pypi",
      "provider_record_id": "USN-5490-1",
      "provider_updated_at": "2026-06-25T13:31:13.973874626Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.1-1.3ubuntu0.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "2.6.1-1.2",
        "2.6.1-1.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-22570",
      "fixed_version": "2.6.1-1.3ubuntu0.1~esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-22570",
      "provider_updated_at": "2026-04-22T12:48:27.202150Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.0-9.1ubuntu1.1"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "3.0.0-9ubuntu5",
        "3.0.0-9ubuntu6",
        "3.0.0-9.1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-22570",
      "fixed_version": "3.0.0-9.1ubuntu1.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-22570",
      "provider_updated_at": "2026-04-22T12:48:27.202150Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.1.3-2ubuntu5.2"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "3.6.1.3-2",
        "3.6.1.3-2ubuntu1",
        "3.6.1.3-2ubuntu3",
        "3.6.1.3-2ubuntu4",
        "3.6.1.3-2ubuntu5"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-22570",
      "fixed_version": "3.6.1.3-2ubuntu5.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-22570",
      "provider_updated_at": "2026-04-22T12:48:27.202150Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.4-1ubuntu7.22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "3.12.4-1ubuntu3",
        "3.12.4-1ubuntu5",
        "3.12.4-1ubuntu6",
        "3.12.4-1ubuntu7"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-22570",
      "fixed_version": "3.12.4-1ubuntu7.22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-22570",
      "provider_updated_at": "2026-04-22T12:48:27.202150Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "leap 15.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2022:1040-1",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2022:1040-1",
      "provider_updated_at": "2026-02-04T04:23:23.290305Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.5.0-5.5.1"
            }
          ]
        }
      ],
      "release": "leap 15.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2022:0823-1",
      "fixed_version": "3.5.0-5.5.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2022:0823-1",
      "provider_updated_at": "2026-02-04T04:01:51.676407Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise installer updates 15 sp2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-1",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-1",
      "provider_updated_at": "2026-02-04T03:11:48.380475Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for basesystem 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-1",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-1",
      "provider_updated_at": "2026-02-04T03:11:48.380475Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for development tools 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-1",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-1",
      "provider_updated_at": "2026-02-04T03:11:48.380475Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for package hub 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-1",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-1",
      "provider_updated_at": "2026-02-04T03:11:48.380475Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for package hub 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-1",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-1",
      "provider_updated_at": "2026-02-04T03:11:48.380475Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for public cloud 15 sp2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-1",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-1",
      "provider_updated_at": "2026-02-04T03:11:48.380475Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for public cloud 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-1",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-1",
      "provider_updated_at": "2026-02-04T03:11:48.380475Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "manager server module 4.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-1",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-1",
      "provider_updated_at": "2026-02-04T03:11:48.380475Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "manager server module 4.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-1",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-1",
      "provider_updated_at": "2026-02-04T03:11:48.380475Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise real time 15 sp2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-1",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-1",
      "provider_updated_at": "2026-02-04T03:11:48.380475Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise micro 5.0",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-1",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-1",
      "provider_updated_at": "2026-02-04T03:11:48.380475Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise micro 5.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-1",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-1",
      "provider_updated_at": "2026-02-04T03:11:48.380475Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "manager server module 4.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-3",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-3",
      "provider_updated_at": "2026-02-04T02:54:45.892873Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15 sp2-espos",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-3",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-3",
      "provider_updated_at": "2026-02-04T02:54:45.892873Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15 sp2-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-3",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-3",
      "provider_updated_at": "2026-02-04T02:54:45.892873Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 15 sp2-bcl",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-3",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-3",
      "provider_updated_at": "2026-02-04T02:54:45.892873Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 15 sp2-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-3",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-3",
      "provider_updated_at": "2026-02-04T02:54:45.892873Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 15 sp2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-3",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-3",
      "provider_updated_at": "2026-02-04T02:54:45.892873Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "manager proxy 4.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-3",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-3",
      "provider_updated_at": "2026-02-04T02:54:45.892873Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "manager retail branch server 4.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-3",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-3",
      "provider_updated_at": "2026-02-04T02:54:45.892873Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "manager server 4.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-3",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-3",
      "provider_updated_at": "2026-02-04T02:54:45.892873Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "enterprise storage 7",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-3",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-3",
      "provider_updated_at": "2026-02-04T02:54:45.892873Z",
      "applicability_unknown": true
    },
    {
      "name": "protobuf",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2-4.12.1"
            }
          ]
        }
      ],
      "release": "linux enterprise micro 5.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1040-2",
      "fixed_version": "3.9.2-4.12.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1040-2",
      "provider_updated_at": "2026-02-04T02:43:11.363038Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [elpa-protobuf-mode]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-3+deb12u1 · all · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · all · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

  • [libprotobuf32]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

  • [libprotobuf-dev]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

  • [libprotobuf-java]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-3+deb12u1 · all · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · all · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

  • [libprotobuf-lite32]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

  • [libprotoc32]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

  • [libprotoc-dev]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

  • [php-google-protobuf]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-3+deb12u1 · all · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · all · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

  • [protobuf-compiler]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

  • [python3-protobuf]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

  • [ruby-google-protobuf]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · bookworm; dsa · protobuf · debian · 12

[Debian 13 (Trixie)]

  • [elpa-protobuf-mode]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-11+deb13u1 · all · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

    • 3.21.12-11+deb13u1 · all · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

  • [libprotobuf32t64]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-11+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

    • 3.21.12-11+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

  • [libprotobuf-dev]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-11+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

    • 3.21.12-11+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

  • [libprotobuf-java]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-11+deb13u1 · all · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

    • 3.21.12-11+deb13u1 · all · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

  • [libprotobuf-lite32t64]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-11+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

    • 3.21.12-11+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

  • [libprotoc32t64]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-11+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

    • 3.21.12-11+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

  • [libprotoc-dev]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-11+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

    • 3.21.12-11+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

  • [php-google-protobuf]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-11+deb13u1 · all · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

    • 3.21.12-11+deb13u1 · all · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

  • [protobuf-compiler]Unknown

    Source package: [protobuf]

    Details (2)

    • 3.21.12-11+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

    • 3.21.12-11+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.21.9-3

      dsa · protobuf · debian · 13

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]