PYSEC-2022-48 CVE-2021-22570 GHSA-77rm-9x9h-xj3g

Withdrawn Advisory: NULL Pointer Dereference in Protocol Buffers

High GoMavenNuGetPackagistPyPI

Severity: 8.7 / 10; High · CVSS 4.0
Exploit chance (EPSS): 2.66%; Chance of exploitation in the next 30 days. Higher than 85.70% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-476 NULL Pointer Dereference
Fix: Available; 5 packages have a fixed version

Description

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/protocolbuffers/protobuf	`< 0.0.0-20210218195015-ae50d9b99025`	`0.0.0-20210218195015-ae50d9b99025`
github.com/protocolbuffers/protobuf	`>= 0.0.0, < 3.15.0`	`3.15.0`
github.com/protocolbuffers/protobuf	`< 0.0.0-20210218195015-ae50d9b99025`	`0.0.0-20210218195015-ae50d9b99025`
github.com/protocolbuffers/protobuf	`>= 0.0.0, < 3.15.0`	`3.15.0`

Maven

Package	Vulnerable	Fixed in
com.google.protobuf:protobuf-java	`< 3.15.0`	`3.15.0`
com.google.protobuf:protobuf-java	`< 3.15.0`	`3.15.0`

NuGet

Package	Vulnerable	Fixed in
Google.Protobuf	`< 3.15.0`	`3.15.0`
Google.Protobuf	`< 3.15.0`	`3.15.0`

Packagist

Package	Vulnerable	Fixed in
google/protobuf	`< 3.15.0`	`3.15.0`
google/protobuf	`< 3.15.0`	`3.15.0`

PyPI

Package	Vulnerable	Fixed in
protobuf	`< 3.15.0`	`3.15.0`
protobuf	`< 3.15.0`	`3.15.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/protocolbuffers/protobuf Go → `0.0.0-20210218195015-ae50d9b99025`

go

go get github.com/protocolbuffers/protobuf@v0.0.0-20210218195015-ae50d9b99025 && go mod tidy

com.google.protobuf:protobuf-java Maven → `3.15.0`

maven

<dependency><groupId>com.google.protobuf</groupId><artifactId>protobuf-java</artifactId><version>3.15.0</version></dependency>

gradle

implementation("com.google.protobuf:protobuf-java:3.15.0")

Google.Protobuf NuGet → `3.15.0`

dotnet

dotnet add package Google.Protobuf --version 3.15.0

google/protobuf Packagist → `3.15.0`

composer

composer require google/protobuf:^3.15.0

protobuf PyPI → `3.15.0`

pip

pip install --upgrade "protobuf>=3.15.0"

poetry

poetry add "protobuf>=3.15.0"

uv

uv add "protobuf>=3.15.0"

Severity breakdown

CVSS 4.0 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): High
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 5.5

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack vector: Local
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Weakness

CWE-476: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How to prevent it

Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Requirements: Select a programming language that is not susceptible to these issues.
Implementation: Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Architecture and Design: Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Implementation: Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.

References

Advisories

Packages

github.com/protocolbuffers/protobuf

Timeline

Jan 26, 2022 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-7gcm-g887-7qv7 protobuf affected by a JSON recursion depth bypass	High	Also affects protobuf
GHSA-8qvm-5x2c-j2w7 protobuf-python has a potential Denial of Service issue	High	Also affects protobuf
GHSA-8gq9-2x98-w8hf protobuf-cpp and protobuf-python have potential Denial of Service issue	High	Also affects protobuf
GHSA-jwvw-v7c5-m82h protobuf susceptible to buffer overflow	High	Also affects github.com/protocolbuffers/protobuf
GHSA-525v-9gp9-w22h Forge: TLS client crash when the server sends no certificate	Medium	Same weakness, CWE-476
GHSA-8hrf-8g6f-7xwp Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message	High	Same weakness, CWE-476
GHSA-cp9v-662q-vvx9 Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0	High	Same weakness, CWE-476
GHSA-27h8-gf7j-v5hc Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images	High	Same weakness, CWE-476

Credits: joshbressers

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor