CVE-2022-1941

19

FAUCET Score

CVE-2022-1941 is a parsing vulnerability in ProtocolBuffers (protobuf-cpp and protobuf-python) versions prior to specified updates, affecting products like Debian, Fedora, and Google. A specially crafted MessageSet type with multiple key-value pairs can lead to out-of-memory errors, resulting in a Denial of Service (DoS) against services processing unsanitized input. This vulnerability has a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity and high impact on availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 3.18.3CPE matchmatch criteria	cpe:2.3:a:google:protobuf-cpp::::::::
		>= 3.19.0, < 3.19.5CPE matchmatch criteria	cpe:2.3:a:google:protobuf-cpp::::::::
		>= 3.20.0, < 3.20.2CPE matchmatch criteria	cpe:2.3:a:google:protobuf-cpp::::::::
		>= 3.21.0, < 3.21.6CPE matchmatch criteria	cpe:2.3:a:google:protobuf-cpp::::::::
		< 3.18.3CPE matchmatch criteria	cpe:2.3:a:google:protobuf-python::::::::

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

1.21%

Probability of exploitation in next 30 days

EPSS Percentile

65.1%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0121 is in the 44th percentile among its peer group of 51,551 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (64)

charmpatch availablevia llm_extracted

Fixed in: protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6), protobuf-python (3.18.3, 3.19.5, 3.20.2, 4.21.6)

microsoftpatch availablevia msrc

Product: cm1 mysql 8.0.32-1 on CBL Mariner 1.0Fixed in: 8.0.32-1

microsoftpatch availablevia msrc

Product: azl3 pytorch 2.2.2-2 on Azure Linux 3.0Fixed in: 2.2.2-2

microsoftpatch availablevia msrc

Product: azl3 tensorflow 2.11.1-1 on Azure Linux 3.0Fixed in: 2.16.1-1

microsoftpatch availablevia msrc

Product: azl3 tensorflow 2.16.1-1 on Azure Linux 3.0Fixed in: 2.16.1-1

microsoftpatch availablevia msrc

Product: azl3 keras 2.11.0-3 on Azure Linux 3.0Fixed in: 3.1.1-1

microsoftpatch availablevia msrc

Product: azl3 keras 3.1.1-1 on Azure Linux 3.0Fixed in: 3.1.1-1

microsoftpatch availablevia msrc

Product: 17080-17084Fixed in: 2.16.2-1

microsoftpatch availablevia msrc

Product: 19696-17084Fixed in: 2.16.2-1

microsoftpatch availablevia msrc

Product: 20279-17084Fixed in: 1.62.0-2

microsoftpatch availablevia msrc

Product: 19690-17084Fixed in: 8.0.40-1

microsoftpatch availablevia msrc

Product: 17218-16823Fixed in: 8.0.40-1

microsoftpatch availablevia msrc

Product: 17607-17084Fixed in: 8.0.40-1

microsoftpatch availablevia msrc

Product: 20360-17084Fixed in: 25.3-1

microsoftpatch availablevia msrc

Product: 18468-17084Fixed in: 25.3-1

microsoftpatch availablevia msrc

Product: 19407-17084Fixed in: 2.2.2-2

microsoftpatch availablevia msrc

Product: 18467-17084Fixed in: 2.2.2-2

microsoftpatch availablevia msrc

Product: 18295-17084Fixed in: 2.16.1-1

microsoftpatch availablevia msrc

Product: 17878-17084Fixed in: 2.16.1-1

microsoftpatch availablevia msrc

Product: 20167-17084Fixed in: 3.1.1-1

microsoftpatch availablevia msrc

Product: 18108-17084Fixed in: 3.1.1-1

microsoftpatch availablevia msrc

Product: 17950-16820Fixed in: 8.0.32-1

microsoftpatch availablevia msrc

Product: 18464-16820Fixed in: 3.14.0-1

microsoftpatch availablevia msrc

Product: 17848-16820Fixed in: 60.9.0-13

microsoftpatch availablevia msrc

Product: 18437-16820Fixed in: 1.35.0-9

microsoftpatch availablevia msrc

Product: 18465-16823Fixed in: 2.0.0-7

microsoftpatch availablevia msrc

Product: 18466-16823Fixed in: 3.17.3-3

microsoftpatch availablevia msrc

Product: 17868-16823Fixed in: 1.42.0-11

microsoftpatch availablevia msrc

Product: Azure Linux 3.0 x64Fixed in: 8.0.40-1

microsoftpatch availablevia msrc

Product: Azure Linux 3.0 ARMFixed in: 8.0.40-1

microsoftpatch availablevia msrc

Product: CBL Mariner 2.0 x64Fixed in: 2.0.0-7

microsoftpatch availablevia msrc

Product: CBL Mariner 2.0 ARMFixed in: 2.0.0-7

microsoftpatch availablevia msrc

Product: Azure Linux 3.0 ARMFixed in: 8.0.40-2

microsoftpatch availablevia msrc

Product: Azure Linux 3.0 x64Fixed in: 8.0.40-2

microsoftpatch availablevia msrc

Product: Azure Linux 3.0 x64Fixed in: 1.62.0-2

microsoftpatch availablevia msrc

Product: Azure Linux 3.0 x64Fixed in: 3.1.1-1

microsoftpatch availablevia msrc

Product: Azure Linux 3.0 x64Fixed in: 25.3-1

microsoftpatch availablevia msrc

Product: Azure Linux 3.0 ARMFixed in: 1.62.0-2

microsoftpatch availablevia msrc

Product: Azure Linux 3.0 ARMFixed in: 3.1.1-1

microsoftpatch availablevia msrc

Product: Azure Linux 3.0 ARMFixed in: 25.3-1

microsoftpatch availablevia msrc

Product: CBL Mariner 2.0 x64Fixed in: 8.0.40-1

microsoftpatch availablevia msrc

Product: CBL Mariner 2.0 x64Fixed in: 3.17.3-3

microsoftpatch availablevia msrc

Product: CBL Mariner 2.0 ARMFixed in: 8.0.40-1

microsoftpatch availablevia msrc

Product: CBL Mariner 2.0 ARMFixed in: 3.17.3-3

microsoftpatch availablevia msrc

Product: cm1 mozjs60 60.9.0-13 on CBL Mariner 1.0Fixed in: 60.9.0-13

microsoftpatch availablevia msrc

Product: cm1 grpc 1.35.0-9 on CBL Mariner 1.0Fixed in: 1.35.0-9

microsoftpatch availablevia msrc

Product: cbl2 pytorch 2.0.0-7 on CBL Mariner 2.0Fixed in: 2.0.0-7

microsoftpatch availablevia msrc

Product: cbl2 protobuf 3.17.3-3 on CBL Mariner 2.0Fixed in: 3.17.3-3

microsoftpatch availablevia msrc

Product: cbl2 grpc 1.42.0-11 on CBL Mariner 2.0Fixed in: 1.42.0-11

microsoftpatch availablevia msrc

Product: azl3 python-tensorboard 2.16.2-1 on Azure Linux 3.0Fixed in: 2.16.2-1

microsoftpatch availablevia msrc

Product: azl3 python-tensorboard 2.11.0-3 on Azure Linux 3.0Fixed in: 2.16.2-1

microsoftpatch availablevia msrc

Product: azl3 grpc 1.42.0-7 on Azure Linux 3.0Fixed in: 1.62.0-2

microsoftpatch availablevia msrc

Product: cm1 protobuf 3.14.0-1 on CBL Mariner 1.0Fixed in: 3.14.0-1

microsoftpatch availablevia msrc

Product: azl3 mysql 8.0.36-1 on Azure Linux 3.0Fixed in: 8.0.40-1

microsoftpatch availablevia msrc

Product: cbl2 mysql 8.0.40-1 on CBL Mariner 2.0Fixed in: 8.0.40-1

microsoftpatch availablevia msrc

Product: azl3 mysql 8.0.40-1 on Azure Linux 3.0Fixed in: 8.0.40-1

microsoftpatch availablevia msrc

Product: azl3 protobuf 3.17.3-2 on Azure Linux 3.0Fixed in: 25.3-1

microsoftpatch availablevia msrc

Product: azl3 protobuf 25.3-1 on Azure Linux 3.0Fixed in: 25.3-1

microsoftpatch availablevia msrc

Product: azl3 pytorch 2.2.2-7 on Azure Linux 3.0Fixed in: 2.2.2-2

pippatch availablevia ghsa

Product: protobufFixed in: 3.20.2

pippatch availablevia ghsa

Product: protobufFixed in: 4.21.6

pippatch availablevia ghsa

Product: protobufFixed in: 3.18.3

pippatch availablevia ghsa

Product: protobufFixed in: 3.19.5

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: protobuf-0:3.14.0-16.el9

Vendor Advisories (7)

microsoft2024-Dec/CVE-2022-1941

CVE-2022-1941

microsoft2024-Nov/CVE-2022-1941

CVE-2022-1941

microsoft2024-Oct/CVE-2022-1941

CVE-2022-1941

pipGHSA-8gq9-2x98-w8hfhigh

protobuf-cpp and protobuf-python have potential Denial of Service issue

redhatCVE-2022-1941Moderate

protobuf: message parsing vulnerability in ProtocolBuffers

microsoft2022-Sep/CVE-2022-1941Important

Out of Memory issue in ProtocolBuffers for cpp and python

charmllm-charm-e485ef13b9ddd575MEDIUM

ProtocolBuffer denial of service vulnerability (CVE-2022-1941)

References

cloud.google.com / support/bulletins

Third Party Advisory

github.com / protocolbuffers/protobuf/security/advisories/GHSA-8gq9-2x98-w8hf

Third Party Advisory

lists.debian.org / debian-lts-announce/2023/04/msg00019.html

Mailing List

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP

security.netapp.com / advisory/ntap-20240705-0001

openwall.com / lists/oss-security/2022/09/27/1

Mailing ListThird Party Advisory