---
id: CVE-2022-1941
aliases:
  - GHSA-8gq9-2x98-w8hf
  - PYSEC-2026-899
title: protobuf-cpp and protobuf-python have potential Denial of Service issue
summary: protobuf-cpp and protobuf-python have potential Denial of Service issue
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: protobuf
product: protobuf
ecosystem: pip
affected:
  - protobuf < 3.18.3
  - 'protobuf >= 3.19.0, < 3.19.5'
  - 'protobuf >= 3.20.0, < 3.20.2'
  - 'protobuf >= 4.0.0, < 4.21.6'
patched:
  - protobuf 3.18.3
  - protobuf 3.19.5
  - protobuf 3.20.2
  - protobuf 4.21.6
published: '2022-09-23'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-8gq9-2x98-w8hf'
references:
  - url: >-
      https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8gq9-2x98-w8hf
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-1941'
  - url: 'https://cloud.google.com/support/bulletins#GCP-2022-019'
  - url: 'https://github.com/protocolbuffers/protobuf'
  - url: 'https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP
  - url: 'https://security.netapp.com/advisory/ntap-20240705-0001'
  - url: 'http://www.openwall.com/lists/oss-security/2022/09/27/1'
tags:
  - osv
  - pip
epss: 0.01502
epssPercentile: 0.73166
ingestedAt: '2026-07-08T18:25:47.490Z'
---

## Overview

### Summary

A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory (OOM) failure when processing a specially crafted message, which could lead to a denial of service (DoS) on services using the libraries.

Reporter: [ClusterFuzz](https://google.github.io/clusterfuzz/)

Affected versions: All versions of C++ Protobufs (including Python) prior to the versions listed below.

### Severity & Impact
As scored by google  
**Medium 5.7** - [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)  
Asscored byt NIST  
**High 7.5** - [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

A small (~500 KB) malicious payload can be constructed which causes the running service to allocate more than 3GB of RAM.

### Proof of Concept

For reproduction details, please refer to the unit test that identifies the specific inputs that exercise this parsing weakness.

### Mitigation / Patching

Please update to the latest available versions of the following packages:
- protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6)
- protobuf-python (3.18.3, 3.19.5, 3.20.2, 4.21.6)

## Affected packages

- `protobuf < 3.18.3`
- `protobuf >= 3.19.0, < 3.19.5`
- `protobuf >= 3.20.0, < 3.20.2`
- `protobuf >= 4.0.0, < 4.21.6`

## Remediation

Upgrade to a patched release:

- `protobuf 3.18.3`
- `protobuf 3.19.5`
- `protobuf 3.20.2`
- `protobuf 4.21.6`