Vulnerabilities

TI-2024-36143 CVE-2024-53984

Nanopb does not release memory on error return when using PB_DECODE_DELIMITED

LOW 20

Nanopb is a small code-size Protocol Buffers implementation.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00409 Published 2024-12-02 Fixed in 0.4.9.1 CWE-401

TI-2014-08406 CVE-2014-125106 · GHSA-2gv7-3f72-xfxx

MEDIUM 51

Nanopb before 0.3.1 allows size_t overflows in pb_dec_bytes and pb_dec_string.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00949 Published 2023-06-17 No fix listed CWE-787

TI-2021-04499 CVE-2021-21401 · GHSA-7mv5-5mxh-qg88

LOW 35

Nanopb is a small code-size Protocol Buffers implementation in ansi C.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.01811 Published 2021-03-23 Fixed in 0.3.9.8, 0.4.5 CWE-763

TI-2020-16064 CVE-2020-26243 · GHSA-85rr-4rh9-hhwh

LOW 38

Nanopb is a small code-size Protocol Buffers implementation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02664 Published 2020-11-25 Partial fix · 0.3.9.7, 0.4.4 CWE-119

TI-2020-04291 CVE-2020-5235 · GHSA-6f6v-26gj-6crp

MEDIUM 46

There is a potentially exploitable out of memory condition In Nanopb before 0.4.1, 0.3.9.5, and 0.2.9.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01726 Published 2020-02-04 Fixed in 0.2.9.4, 0.3.9.5 +1 CWE-125