{"id":"CVE-2020-26243","aliases":["GHSA-85rr-4rh9-hhwh","PYSEC-2026-684"],"title":"Memory leak in Nanopb","summary":"Memory leak in Nanopb","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"nanopb","product":"nanopb","ecosystem":"pip","affected":["nanopb >= 0.3.2, < 0.3.9.7","nanopb >= 0.4.0, < 0.4.4"],"patched":["nanopb 0.3.9.7","nanopb 0.4.4"],"published":"2020-11-25","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-85rr-4rh9-hhwh","references":[{"url":"https://github.com/nanopb/nanopb/security/advisories/GHSA-85rr-4rh9-hhwh"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26243"},{"url":"https://github.com/nanopb/nanopb/issues/615"},{"url":"https://github.com/nanopb/nanopb/commit/4fe23595732b6f1254cfc11a9b8d6da900b55b0c"},{"url":"https://github.com/nanopb/nanopb/blob/2b48a361786dfb1f63d229840217a93aae064667/CHANGELOG.txt"}],"tags":["osv","pip"],"epss":0.02664,"epssPercentile":0.85059,"ingestedAt":"2026-07-08T18:25:47.307Z","slug":"CVE-2020-26243","body":"## Overview\n\n### Impact\nDecoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed.\n\n### Patches\nPreliminary patch is [available on git](https://github.com/nanopb/nanopb/commit/edf6dcbffee4d614ac0c2c1b258ab95185bdb6e9) and problem will be patched in versions 0.3.9.7 and 0.4.4 once testing has been completed.\n\n### Workarounds\nFollowing workarounds are available:\n* Set the option `no_unions` for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code.\n* Set the type of the submessage field inside oneof to `FT_POINTER`. This way the whole submessage will be dynamically allocated and the problematic code is not executed.\n* Use an arena allocator for nanopb, to make sure all memory can be released afterwards.\n\n### References\nBug report: https://github.com/nanopb/nanopb/issues/615\n\n### For more information\nIf you have any questions or comments about this advisory, comment on the bug report linked above.\n\n## Affected packages\n\n- `nanopb >= 0.3.2, < 0.3.9.7`\n- `nanopb >= 0.4.0, < 0.4.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nanopb 0.3.9.7`\n- `nanopb 0.4.4`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.5,"exploitation":0,"ransomware":0},"changes":[]}