CVE-2019-15544
Uncontrolled memory consumption in protobuf
CVE-2019-15544 is a high vulnerability (CVSS 7.5) in Apache Hbase, published June 8, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.76%, the 90th percentile. Fixed in protobuf 2.6.0.
- Severity
- 7.5 HighCVSS 3.1, NVD
- Exploit chance
- 3.76%EPSS, 90th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.6.0protobuf +1 more
Description
An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
What each source reports
NVD Score used
An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.
- Record
CVE-2019-15544- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-770
- Updated
- 2026-11-02
CVE ListNo score
An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.
- Record
CVE-2019-15544- Updated
- 2026-11-02
EUVDEUVD-2021-1801No score
An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.
- Record
EUVD-2021-1801- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mh6h-f25p-98f8
Uncontrolled memory consumption in protobuf
Affected versions of this crate called Vec::reserve() on user-supplied input. This allows an attacker to cause an Out of Memory condition while calling the vulnerable method on untrusted data.
- Record
GHSA-mh6h-f25p-98f8- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.
- Record
CVE-2019-15544- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-mh6h-f25p-98f8
Uncontrolled memory consumption in protobuf
Affected versions of this crate called Vec::reserve() on user-supplied input. This allows an attacker to cause an Out of Memory condition while calling the vulnerable method on untrusted data.
- Record
GHSA-mh6h-f25p-98f8- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVRUSTSEC-2019-0003
Out of Memory in stream::read_raw_bytes_into()
Affected versions of this crate called Vec::reserve() on user-supplied input.
This allows an attacker to cause an Out of Memory condition while calling the vulnerable method on untrusted data.
- Record
RUSTSEC-2019-0003- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
rustsec.org/advisories/RUSTSEC-2019-0003.html
lists.apache.org/thread.html/r4ef574a5621b0e670a3ce641e9922543e34f22bf4c9ee9584aa67fcf%40%3Cissues.hbase.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2019-15544
Show 8 moreShow less
github.com/stepancheg/rust-protobuf/issues/411
crates.io/crates/protobuf