An issue was discovered in the protobuf crate before 2.6.0 for Rust.
Priority LOW 39CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.
Why it matters now
EPSS 0.03764 89th percentileScored 2026-11-07
Fix Fixed protobuf (crates.io): 2.6.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | protobuf (crates.io) | before 2.6.0 | 2.6.0 | Patch available | GHSA-mh6h-f25p-98f8 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- protobuf (crates.io) Vendor— Affected before 2.6.0 Fixed in 2.6.0 Patch available GHSA-mh6h-f25p-98f8
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rust-protobuf_project:rust-protobuf:*:*:*:*:*:*:*:* | before 1.7.5; 2.0.0 to before 2.6.0 | Vulnerable | Rust-protobuf Project |
| cpe:2.3:a:apache:hbase:2.2.3:*:*:*:*:*:*:* | 2.2.3 | Vulnerable | Apache |
- cpe:2.3:a:rust-protobuf_project:rust-protobuf:*:*:*:*:*:*:*:* Versions before 1.7.5; 2.0.0 to before 2.6.0 Vulnerable ·Rust-protobuf Project
- cpe:2.3:a:apache:hbase:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Apache
Remediation
- Fix · GHSA-mh6h-f25p-98f8 protobuf (crates.io) Fixed in 2.6.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-15544
- 2026-10-03 Alias added: GHSA-mh6h-f25p-98f8
References
Advisory 2
Other 10
- [hbase-issues] 20210828 [jira] [Commented] (HBASE-26234) Protobuf-java-2.5.0.jar Has Several Security Vulnerabilities,CVE-2015-5237,CVE-2019-15544
- [hbase-dev] 20210828 [jira] [Created] (HBASE-26234) Protobuf-java-2.5.0.jar Has Several Security Vulnerabilities,CVE-2015-5237,CVE-2019-15544
- [hbase-issues] 20210828 [jira] [Created] (HBASE-26234) Protobuf-java-2.5.0.jar Has Several Security Vulnerabilities,CVE-2015-5237,CVE-2019-15544
- [hadoop-common-issues] 20210902 [jira] [Updated] (HADOOP-17860) Upgrade third party protobuf-java-2.5.0.jar to address vulnerabilities #CVE-2015-5237, CVE-2019-15544
- https://github.com/stepancheg/rust-protobuf/issues/411
- https://github.com/stepancheg/rust-protobuf
- https://lists.apache.org/thread.html/r00097d0b5b6164ea428554007121d5dc1f88ba2af7b9e977a10572cd@%3Cdev.hbase.apache.org%3E
- https://lists.apache.org/thread.html/r4ef574a5621b0e670a3ce641e9922543e34f22bf4c9ee9584aa67fcf@%3Cissues.hbase.apache.org%3E
- https://lists.apache.org/thread.html/r7fed8dd9bee494094e7011cf3c2ab75bd8754ea314c6734688c42932@%3Ccommon-issues.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/rd64381fb8f92d640c1975dc50dcdf1b8512e02a2a7b20292d3565cae@%3Cissues.hbase.apache.org%3E
Sources
- CVE-2019-15544 · CVE Program
- CVE-2019-15544 · NVD
- FIRST EPSS
- GHSA-mh6h-f25p-98f8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences