Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Apache Protocol Buffers Vulnerability in Red Hat Products

published 8 months ago

Summary

A security issue has been found in the Apache Protocol Buffers library used by various Red Hat products. This issue allows an attacker to execute arbitrary code on a system. Red Hat has released updates to fix this issue. Affected users should apply these updates as soon as possible.

What to do

Update redhat protobuf to version 0:3.14.0-13.el9_2.1.
Update redhat protobuf-compiler-debuginfo to version 0:3.14.0-13.el9_2.1.
Update redhat protobuf-debuginfo to version 0:3.14.0-13.el9_2.1.
Update redhat protobuf-debugsource to version 0:3.14.0-13.el9_2.1.
Update redhat protobuf-lite to version 0:3.14.0-13.el9_2.1.
Update redhat protobuf-lite-debuginfo to version 0:3.14.0-13.el9_2.1.
Update redhat python3-protobuf to version 0:3.14.0-13.el9_2.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:9.2::appstream	redhat	protobuf	< 0:3.14.0-13.el9_2.1 Fix: upgrade to 0:3.14.0-13.el9_2.1
Red Hat:rhel_e4s:9.2::appstream	redhat	protobuf-compiler-debuginfo	< 0:3.14.0-13.el9_2.1 Fix: upgrade to 0:3.14.0-13.el9_2.1
Red Hat:rhel_e4s:9.2::appstream	redhat	protobuf-debuginfo	< 0:3.14.0-13.el9_2.1 Fix: upgrade to 0:3.14.0-13.el9_2.1
Red Hat:rhel_e4s:9.2::appstream	redhat	protobuf-debugsource	< 0:3.14.0-13.el9_2.1 Fix: upgrade to 0:3.14.0-13.el9_2.1
Red Hat:rhel_e4s:9.2::appstream	redhat	protobuf-lite	< 0:3.14.0-13.el9_2.1 Fix: upgrade to 0:3.14.0-13.el9_2.1
Red Hat:rhel_e4s:9.2::appstream	redhat	protobuf-lite-debuginfo	< 0:3.14.0-13.el9_2.1 Fix: upgrade to 0:3.14.0-13.el9_2.1
Red Hat:rhel_e4s:9.2::appstream	redhat	python3-protobuf	< 0:3.14.0-13.el9_2.1 Fix: upgrade to 0:3.14.0-13.el9_2.1

Original advisory text

Red Hat Security Advisory: protobuf security update

References

https://access.redhat.com/errata/RHSA-2026:3220 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2432398 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3220.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-0994 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-0994 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-0994 Vendor Advisory
https://github.com/protocolbuffers/protobuf/pull/25239 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published25 Feb 2026

Updated25 Mar 2026

First seen25 Mar 2026

Sources

RHSA-2026:3220 · OSV

Track software like this

Free during beta