VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/gogo/protobuf: vulnerability history, versions and safety

github.com/gogo/protobuf is a package in the Go ecosystem. Vulert records 3 vulnerabilities for it across 120 releases, from Apr 2021 to Mar 2022. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
3 vulnerabilities recorded H1 U2
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/gogo/protobuf vulnerabilities

Vulert verdict on github.com/gogo/protobuf v1.3.2 i

Updated on 23 Oct 2026

Action needed: v1.3.2 has 3 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 68/100
  • Security Minor issues
  • Maintenance Slowing
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v1.3.2 — affected i
  • Vulnerabilities on record 3 over 1 year · 0 in the last year i
  • Latest disclosure 28 Mar 2022 i
  • Highest CVSS 8.6 i
  • With no published fix 0 i
  • Stars 5,655 i
  • OpenSSF scorecard 3/10 i
  • Last release 69 months ago i
  • Licence BSD-3-Clause i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/gogo/protobuf, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20221024144010-f67b8970b736 24 Oct 2022 H1 U2 BSD-3-Clause Yes Details →
v1.3.2-0.20221024144010-f67b8970b736 24 Oct 2022 H1 U2 BSD-3-Clause Yes Details →
v1.3.3-0.20221024144010-f67b8970b736 24 Oct 2022 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20220703181809-8892e00f9446 03 Jul 2022 H1 U2 BSD-3-Clause Yes Details →
v1.3.3-0.20220703181809-8892e00f9446 03 Jul 2022 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20210702135956-226206f39bd7 02 Jul 2021 H1 U2 BSD-3-Clause Yes Details →
v1.3.2-0.20210702135956-226206f39bd7 02 Jul 2021 H1 U2 BSD-3-Clause Yes Details →
v1.3.3-0.20210702135956-226206f39bd7 02 Jul 2021 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20210110080147-b03c65ea87cd 10 Jan 2021 H1 U2 BSD-3-Clause Yes Details →
v1.3.2 10 Jan 2021 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20210107134041-550e88954e61 07 Jan 2021 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20210107134041-550e88954e61 07 Jan 2021 H1 U2 BSD-3-Clause Yes Details →
v1.3.2-0.20210107134041-550e88954e61 07 Jan 2021 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20200807193113-deb6fe8ca7c6 07 Aug 2020 H1 U2 BSD-3-Clause Yes Details →
v1.3.2-0.20200807193113-deb6fe8ca7c6 07 Aug 2020 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20191014061517-5628607bb4c5 14 Oct 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20191014061517-5628607bb4c5 14 Oct 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1 14 Oct 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20191014061517-5628607bb4c5 14 Oct 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20191011140731-09ab7735f775 11 Oct 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20191011140731-09ab7735f775 11 Oct 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20191011132018-8142193b881b 11 Oct 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20191011131404-627c0c9b4094 11 Oct 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20191006172112-69adf3ecd52d 06 Oct 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20191006172112-69adf3ecd52d 06 Oct 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20190917182448-a0164e12ef1d 17 Sep 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190908201246-8a5ed79f6888 08 Sep 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20190908201246-8a5ed79f6888 08 Sep 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20190908195152-33d47608f2cc 08 Sep 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20190908193526-f99a381921da 08 Sep 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20190908191135-d1969a75bbab 08 Sep 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20190908171136-3f2ed6d08ef6 08 Sep 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190904210650-23325ce401c6 04 Sep 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20190904210650-23325ce401c6 04 Sep 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190902052148-1d64e234ea8e 02 Sep 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20190902052148-1d64e234ea8e 02 Sep 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20190901114253-31f7c0af6034 01 Sep 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.1-0.20190901112808-cb8f588371ec 01 Sep 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190901111031-0ca988a254f9 01 Sep 2019 H1 U2 BSD-3-Clause Yes Details →
v1.3.0 01 Sep 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190818160850-4c00d2f19fb9 18 Aug 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190818160850-4c00d2f19fb9 18 Aug 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190730201129-28a6bbf47e48 30 Jul 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20190730201129-28a6bbf47e48 30 Jul 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190730201129-28a6bbf47e48 30 Jul 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190730171154-f6077aeef29d 30 Jul 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190730164347-0592a1c8d829 30 Jul 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190723190241-65acae22fc9d 23 Jul 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20190723190241-65acae22fc9d 23 Jul 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190723190241-65acae22fc9d 23 Jul 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190611061853-dadb62585089 11 Jun 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190611061853-dadb62585089 11 Jun 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190601103108-21df5aa0e680 01 Jun 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190601103108-21df5aa0e680 01 Jun 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190523194103-871f82e6d4d5 23 May 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190523194103-871f82e6d4d5 23 May 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190519172045-285f4c7b208c 19 May 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190519172045-285f4c7b208c 19 May 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190514041616-aaa2bc4a7213 14 May 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190514041616-aaa2bc4a7213 14 May 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190513192623-8e354f2dee11 13 May 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190513192229-53545f30988d 13 May 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190513173619-abf48d6e8c2b 13 May 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190513173246-ce736d2dbdfb 13 May 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190415061611-67e450fba694 15 Apr 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190415061611-67e450fba694 15 Apr 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190415043412-4f05d35e7378 15 Apr 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190412054829-62e57a106709 12 Apr 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190412054829-62e57a106709 12 Apr 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190324160722-382325bbbb4d 24 Mar 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190324160722-382325bbbb4d 24 Mar 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190316100346-88dda4156dab 16 Mar 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190316100346-88dda4156dab 16 Mar 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190306082329-c5a62797aee0 06 Mar 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.2-0.20190306082329-c5a62797aee0 06 Mar 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20190218063003-ba06b47c162d 18 Feb 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.1 18 Feb 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20190218063003-ba06b47c162d 18 Feb 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20190218060653-4304ca628316 18 Feb 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20190218054825-0971fc63aa45 18 Feb 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20190218054822-2c97b2237c02 18 Feb 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20190218054817-4a306f67bf0f 18 Feb 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20190218054553-53c36c5b9491 18 Feb 2019 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20190218053244-00e1f470a4c0 18 Feb 2019 H1 U2 BSD-3-Clause Yes Details →
v0.0.0-20181231100452-8e4a75f11384 31 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181231100452-8e4a75f11384 31 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181231095956-46a64e8455aa 31 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181231085953-b89f25a5a818 31 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181230205134-881bfbc1e5ee 30 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181230195900-92e5581ace4f 30 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181230194929-6f1fe6c5ee50 30 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181230194229-85491e2f7e8a 30 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181230193408-c1ef72aecdb7 30 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181230192811-02e14781fd2e 30 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181230190300-67585b32fc77 30 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181230185405-7abddc8b30b7 30 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181230184611-a09e15fd10cc 30 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181230184312-fab92d2dc97a 30 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181230183906-4651555b1566 30 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181230182517-16065b7e7049 30 Dec 2018 H1 U2 BSD-3-Clause Yes Details →
v1.2.1-0.20181230182408-6638074d90bb 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230181521-5d42846426e9 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230181024-12526df622c5 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230180409-cdac2c342c2b 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230162105-965a51859114 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230153341-84936e5ca5fd 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230152834-c068e364753d 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230152330-d422d6ff2d57 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230150449-077a400e883e 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230145457-c73379166bca 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230145121-c91db5d11d47 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230144441-e900a595ed6f 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230142916-5960664ad164 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230121056-bce591d6bfb1 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230120958-ec905a6b3014 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230120449-463423b848e1 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230120008-49a30fc8ce5f 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230114242-1ce6663a34a6 30 Dec 2018 H1 U2 — Yes Details →
v0.0.0-20181230113515-9b873568ae14 30 Dec 2018 H1 U2 — Yes Details →
v1.2.1-0.20181230113515-9b873568ae14 30 Dec 2018 H1 U2 — Yes Details →

The newest 120 of 1,160 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 2
  • 2022 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 3 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/gogo/protobuf

The 3 most severe of 3 vulnerabilities recorded for this package

Search all 3 in the database →
Vulnerability Severity Fixed version ↑ Disclosed ↑
CVE-2021-3121: Improper Input Validation in GoGo Protobuf 8.6 high 1.3.2 28 Mar 2022
CVE-2021-3121: Improper Input Validation in GoGo Protobuf N/A unrated 1.3.2 14 Apr 2021
CVE-2021-3121: Panic due to improper input validation in github.com/gogo/protobuf N/A unrated 1.3.2 14 Apr 2021

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/gogo/protobuf

Is github.com/gogo/protobuf safe to use?

Vulert records 3 vulnerabilities for github.com/gogo/protobuf in Go: 0 critical, 1 high, 0 medium and 0 low, plus 2 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/gogo/protobuf's Vulert package health score?

Vulert scores github.com/gogo/protobuf 68/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/gogo/protobuf affected?

Yes. v1.3.2, the version you would install today, has 3 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/gogo/protobuf should I use?

v1.3.2 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/gogo/protobuf have?

3 vulnerabilities are recorded for github.com/gogo/protobuf in the Go ecosystem: 0 critical, 1 high, 0 medium and 0 low, plus 2 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/gogo/protobuf vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/gogo/protobuf in the last 12 months, and the oldest entry in this database dates to 14 Apr 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/gogo/protobuf are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/gogo/protobuf for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/gogo/protobuf version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.