openSUSE-SU-2026:20390-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20390-1.json

JSON Data

https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:20390-1

Upstream

CVE (2)

Related

CVE (2)

Published

2026-03-18T18:15:53Z

Modified

2026-03-26T17:24:06Z

Summary

Security update for protobuf

Details

This update for protobuf fixes the following issues:

Security fixes:

CVE-2025-4565: Fixed parsing of untrusted Protocol Buffers data containing an arbitrary number of recursive groups or messages that could lead to crash due to RecursionError (bsc#1244663).
CVE-2026-0994: Fixed google.protobuf.Any recursion depth bypass in Python json_format.ParseDict (bsc#1257173).

Other fixes:

Fixed import issues of reverse-dependency packages within the google namespace (bsc#1244918).

References

Affected packages

openSUSE:Leap 16.0 / protobuf

Package

Name: protobuf
Purl: pkg:rpm/opensuse/protobuf&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

28.3-160000.3.1

Ecosystem specific

{
    "binaries": [
        {
            "libprotobuf-lite28_3_0": "28.3-160000.3.1",
            "libprotobuf28_3_0": "28.3-160000.3.1",
            "libprotoc28_3_0": "28.3-160000.3.1",
            "libutf8_range-28_3_0": "28.3-160000.3.1",
            "protobuf-devel": "28.3-160000.3.1",
            "protobuf-java": "28.3-160000.3.1",
            "protobuf-java-bom": "28.3-160000.3.1",
            "protobuf-java-javadoc": "28.3-160000.3.1",
            "protobuf-java-parent": "28.3-160000.3.1",
            "python313-protobuf": "5.28.3-160000.3.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20390-1.json"

openSUSE:Leap 16.0 / protobuf-java

Package

Name: protobuf-java
Purl: pkg:rpm/opensuse/protobuf-java&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

28.3-160000.3.1

Ecosystem specific

{
    "binaries": [
        {
            "libprotobuf-lite28_3_0": "28.3-160000.3.1",
            "libprotobuf28_3_0": "28.3-160000.3.1",
            "libprotoc28_3_0": "28.3-160000.3.1",
            "libutf8_range-28_3_0": "28.3-160000.3.1",
            "protobuf-devel": "28.3-160000.3.1",
            "protobuf-java": "28.3-160000.3.1",
            "protobuf-java-bom": "28.3-160000.3.1",
            "protobuf-java-javadoc": "28.3-160000.3.1",
            "protobuf-java-parent": "28.3-160000.3.1",
            "python313-protobuf": "5.28.3-160000.3.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20390-1.json"

openSUSE:Leap 16.0 / python-protobuf

Package

Name: python-protobuf
Purl: pkg:rpm/opensuse/python-protobuf&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.28.3-160000.3.1

Ecosystem specific

{
    "binaries": [
        {
            "libprotobuf-lite28_3_0": "28.3-160000.3.1",
            "libprotobuf28_3_0": "28.3-160000.3.1",
            "libprotoc28_3_0": "28.3-160000.3.1",
            "libutf8_range-28_3_0": "28.3-160000.3.1",
            "protobuf-devel": "28.3-160000.3.1",
            "protobuf-java": "28.3-160000.3.1",
            "protobuf-java-bom": "28.3-160000.3.1",
            "protobuf-java-javadoc": "28.3-160000.3.1",
            "protobuf-java-parent": "28.3-160000.3.1",
            "python313-protobuf": "5.28.3-160000.3.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20390-1.json"