CVE-2021-22570: Nullptr dereference vulnerability in protobuf
Summary
CVE-2021-22570: Nullptr dereference when a null char is present in a proto symbol. Affects protobuf versions < 3.15.0. Fixed in 3.15.0. How to fix ↓
Also tracked for
- Google.Protobuf · NuGet
- Google.Protobuf · NuGet
- protobuf · Debian:11
The same CVE-2021-22570 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Protobuf is a popular open-source library used for serializing structured data. It provides a language-agnostic interface for defining data structures and generating code for various programming languages. This vulnerability affects the PyPI package 'protobuf' and is present in versions prior to 3.15.0. The vulnerability arises from a nullptr dereference when a null character is present in a proto symbol. This leads to incorrect parsing of the symbol and an unchecked call into the proto file's name during the generation of an error message. As a result, the file becomes nullptr, leading to potential security issues.
Vulnerability Detail
The vulnerability in protobuf arises due to a nullptr dereference when a null character is present in a proto symbol. This causes the symbol to be parsed incorrectly, leading to an unchecked call into the proto file's name during the generation of an error message. Since the symbol is incorrectly parsed, the file becomes nullptr, which can result in security vulnerabilities. The vulnerability can be exploited by an attacker to potentially execute arbitrary code or cause a denial of service (DoS) condition. It is recommended to upgrade to version 3.15.0 or later to mitigate this vulnerability.
How To Fix
Latest published version: 7.36.2 as of 23 Oct 2026
pip install --upgrade "protobuf==7.36.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.15.0
This is the first release that contains the fix.
pip install --upgrade "protobuf==3.15.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the 'protobuf' package to ensure the security of the application.
Conclusion
The vulnerability in the 'protobuf' package (CVE-2021-22570) arises from a nullptr dereference when a null character is present in a proto symbol. It can lead to potential security issues, including arbitrary code execution and denial of service. To mitigate this vulnerability, it is crucial to upgrade to version 3.15.0 or later of the 'protobuf' package. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for protobuf →
FAQ
The vulnerability can be exploited by an attacker to potentially execute arbitrary code or cause a denial of service (DoS) condition.
Versions prior to 3.15.0 of the 'protobuf' package are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and Vulert will analyze it for open-source vulnerabilities in real-time.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of the 'protobuf' package.
You can find more information about this vulnerability in the PyPA Advisory Database (https://github.com/pypa/advisory-database/blob/main/vulns/protobuf/PYSEC-2022-48.yaml).
Related vulnerabilities
Recent vulnerabilities recorded for protobuf.
