Upstream information

CVE-2024-53984 at MITRE

Description

Nanopb is a small code-size Protocol Buffers implementation. When the compile time option PB_ENABLE_MALLOC is enabled, the message contains at least one field with FT_POINTER field type, custom stream callback is used with unknown stream length. and the pb_decode_ex() function is used with flag PB_DECODE_DELIMITED, then the pb_decode_ex() function does not automatically call pb_release(), like is done for other failure cases. This could lead to memory leak and potential denial-of-service. This vulnerability is fixed in 0.4.9.1.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v3 Scores
CVSS detail CNA (GitHub)
Base Score 4.3
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact Low
CVSSv3 Version 3.1
SUSE Bugzilla entry: 1234088 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Package Hub 15 SP5
  • libprotobuf-nanopb0 >= 0.4.6-bp155.3.3.1
  • nanopb-devel >= 0.4.6-bp155.3.3.1
  • nanopb-source >= 0.4.6-bp155.3.3.1
 Patchnames:
openSUSE-2025-40
SUSE Package Hub 15 SP6
  • libprotobuf-nanopb0 >= 0.4.6-bp156.4.3.1
  • nanopb-devel >= 0.4.6-bp156.4.3.1
  • nanopb-source >= 0.4.6-bp156.4.3.1
 Patchnames:
openSUSE-2024-400
openSUSE Leap 15.5
  • libprotobuf-nanopb0 >= 0.4.6-bp155.3.3.1
  • nanopb-devel >= 0.4.6-bp155.3.3.1
  • nanopb-source >= 0.4.6-bp155.3.3.1
 Patchnames:
openSUSE-2025-40
openSUSE Leap 15.6
  • libprotobuf-nanopb0 >= 0.4.6-bp156.4.3.1
  • nanopb-devel >= 0.4.6-bp156.4.3.1
  • nanopb-source >= 0.4.6-bp156.4.3.1
 Patchnames:
openSUSE-2024-400

SUSE Timeline for this CVE

CVE page created: Mon Dec 2 18:01:14 2024
CVE page last modified: Mon Oct 6 20:02:17 2025