CVE-2018-3738
Denial of Service in protobufjs
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
- Record
CVE-2018-3738- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-770, CWE-185
- Updated
- 2026-11-02
CVE List No score
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
- Record
CVE-2018-3738- Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2018-0532 No score
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
- Record
EUVD-2018-0532- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-762f-c2wg-m8c8
Denial of Service in protobufjs
Versions of protobufjs before 5.0.3 and 6.8.6 are vulnerable to a regular expression denial of service when parsing crafted invalid *.proto files.
Recommendation
Update to version 5.0.3, 6.8.6 or later.
- Record
GHSA-762f-c2wg-m8c8- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSV
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
- Record
CVE-2018-3738- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-762f-c2wg-m8c8
Denial of Service in protobufjs
Versions of protobufjs before 5.0.3 and 6.8.6 are vulnerable to a regular expression denial of service when parsing crafted invalid *.proto files.
Recommendation
Update to version 5.0.3, 6.8.6 or later.
- Record
GHSA-762f-c2wg-m8c8- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVCLSA-2026-1784769544 No score
TuxCare security update for protobufjs (8 CVEs)
TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 2.2.1-tuxcare.1.
- Record
CLSA-2026-1784769544- Updated
- 2026-11-02
OSVCLSA-2026-1785291242 No score
TuxCare security update for protobufjs (1 CVE)
TuxCare rebuilt protobufjs to address 1 CVE. Fixed in 5.0.0-tuxcare.1.
- Record
CLSA-2026-1785291242- Updated
- 2026-11-02
OSVCLSA-2026-1792490720 No score
TuxCare security update for protobufjs (12 CVEs)
TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 3.8.2-tuxcare.1.
- Record
CLSA-2026-1792490720- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
protobufjsnpm |
6.0.0 up to 6.8.6 | 6.8.6 |
protobufjsnpm |
before 5.0.3 | 5.0.3 |
protobufjsTuxCare:npm From an advisory covering 8 CVEs |
2.2.1-tuxcare.0 up to 2.2.1-tuxcare.1, plus listed versions 2.2.1 |
2.2.1-tuxcare.1 |
protobufjsTuxCare:npm |
5.0.0-tuxcare.0 up to 5.0.0-tuxcare.1, plus listed versions 5.0.0 |
5.0.0-tuxcare.1 |
protobufjsTuxCare:npm From an advisory covering 12 CVEs |
3.8.2-tuxcare.0 up to 3.8.2-tuxcare.1, plus listed versions 3.8.2 |
3.8.2-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-3738 is a medium vulnerability (CVSS 5.5) in Protobufjs Project Protobufjs, published June 7, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.94%, the 61st percentile. Fixed in protobufjs 6.8.6.