CVE-2015-5237

protobuf susceptible to buffer overflow

8.8 HighFix available

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

4.96%Up 2.4 points since Feb 4, 2022

What each source reports

NVD Score used 8.8

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

Record: CVE-2015-5237
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-787
Updated: 2026-11-02

CVE List No score

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

Record: CVE-2015-5237
Updated: 2026-11-02

EUVDEUVD-2017-0100 No score

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

Record: EUVD-2017-0100
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jwvw-v7c5-m82h 8.7

protobuf susceptible to buffer overflow

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

Record: GHSA-jwvw-v7c5-m82h
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSV 8.8

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

Record: CVE-2015-5237
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-5237 8.8

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

Record: DEBIAN-CVE-2015-5237
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVGHSA-jwvw-v7c5-m82h 8.7

protobuf susceptible to buffer overflow

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

Record: GHSA-jwvw-v7c5-m82h
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSVPYSEC-2017-150 8.8

Withdrawn as duplicate of PYSEC-2017-65 protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

Record: PYSEC-2017-150
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-5237 8.8

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

Record: UBUNTU-CVE-2015-5237
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVPYSEC-2017-65 No score

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

Record: PYSEC-2017-65
Updated: 2026-11-02

OSVUSN-5769-1 No score

protobuf vulnerabilities

It was discovered that protobuf did not properly manage memory when serializing large messages. An attacker could possibly use this issue to cause applications using protobuf to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-5237)

It was discovered that protobuf did not properly manage memory when parsing specifically crafted messages. An attacker could possibly use this issue to cause applications using protobuf to crash, resulting in a denial of service. (CVE-2022-1941)

Record: USN-5769-1
Updated: 2026-11-02

Affected products

google protobuf

Affected packages

Affected packages
Package	Affected	Fixed
`Google.Protobuf` NuGet	before 3.4.0	3.4.0
`google/protobuf` Packagist	before 3.4.0	3.4.0
`protobuf` PyPI	before 3.4.0	3.4.0
`github.com/protocolbuffers/protobuf` Go	Source text: > 0.0.0, < 3.4.0	3.4.0Not evaluated
`github.com/protocolbuffers/protobuf` Go	before 0.0.0-20170815233912-80a37e0782d2	0.0.0-20170815233912-80a37e0782d2
`protobuf` Debian:12	All versions, plus listed versions 3.21.12-103.21.12-113.21.12-123.21.12-133.21.12-14 Show 25 moreShow less 3.21.12-153.21.12-163.21.12-33.21.12-3+deb12u13.21.12-43.21.12-53.21.12-63.21.12-73.21.12-83.21.12-8.13.21.12-8.23.21.12-93.25.1-13.25.2-13.25.3-13.25.4-13.25.4-23.25.4-33.25.4-43.25.7-135.1-136.0~rc1-136.0~rc2-14.0.0~rc1-14.0.0~rc2-1	None known
`protobuf` Debian:13	All versions, plus listed versions 3.21.12-113.21.12-11+deb13u13.21.12-123.21.12-133.21.12-14 Show 15 moreShow less 3.21.12-153.21.12-163.25.1-13.25.2-13.25.3-13.25.4-13.25.4-23.25.4-33.25.4-43.25.7-135.1-136.0~rc1-136.0~rc2-14.0.0~rc1-14.0.0~rc2-1	None known
`protobuf` Debian:14	All versions, plus listed versions 3.21.12-113.21.12-123.21.12-133.21.12-143.21.12-15 Show 14 moreShow less 3.21.12-163.25.1-13.25.2-13.25.3-13.25.4-13.25.4-23.25.4-33.25.4-43.25.7-135.1-136.0~rc1-136.0~rc2-14.0.0~rc1-14.0.0~rc2-1	None known
`Google.Protobuf` NuGet	before 3.4.0, plus listed versions 0.0.1-test13.0.03.0.0-alpha43.0.0-beta23.0.0-beta3 Show 6 moreShow less 3.0.0-beta43.1.03.2.03.2.0-rc13.2.0-rc23.3.0	3.4.0
`com.google.protobuf:protobuf-parent` Maven	before 3.4.0, plus listed versions 3.0.03.0.0-beta-33.0.0-beta-43.0.23.1.0 Show 5 moreShow less 3.2.03.2.0-rc.13.2.0rc23.3.03.3.1	3.4.0

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`github.com/protocolbuffers/protobuf` Go	before 3.4.0	3.4.0
`google/protobuf` Packagist	before 3.4.0, plus listed versions v3.1.0-alpha-1v3.2.0-alpha-1v3.3.0v3.3.0rc1v3.3.1 Show 4 moreShow less v3.3.2v3.4.0rc1v3.4.0rc2v3.4.0rc3	3.4.0
`protobuf` PyPI	before 3.4.0, plus listed versions 2.0.0beta2.0.32.3.02.4.12.5.0 Show 20 moreShow less 2.6.02.6.13.0.03.0.0a23.0.0a33.0.0b13.0.0b1.post13.0.0b1.post23.0.0b23.0.0b2.post13.0.0b2.post23.0.0b33.0.0b43.1.03.1.0.post13.2.03.2.0rc13.2.0rc1.post13.2.0rc23.3.0	3.4.0
`protobuf` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 2.4.1-3ubuntu22.4.1-3ubuntu32.4.1-3ubuntu42.5.0-5ubuntu22.5.0-7ubuntu12.5.0-8ubuntu12.5.0-9ubuntu12.5.0-9ubuntu1+esm1	None known
`protobuf` Ubuntu:Pro:16.04:LTS	before 2.6.1-1.3ubuntu0.1~esm2, plus listed versions 2.6.1-1.22.6.1-1.32.6.1-1.3ubuntu0.1~esm1	2.6.1-1.3ubuntu0.1~esm2
`protobuf` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 3.0.0-9ubuntu53.0.0-9ubuntu63.0.0-9.1ubuntu13.0.0-9.1ubuntu1.13.0.0-9.1ubuntu1.1+esm33.0.0-9.1ubuntu1.1+esm4	None known
`protobuf` Ubuntu:Pro:16.04:LTS From an advisory covering 2 CVEs	before 2.6.1-1.3ubuntu0.1~esm2, plus listed versions 2.6.1-1.22.6.1-1.32.6.1-1.3ubuntu0.1~esm1	2.6.1-1.3ubuntu0.1~esm2

Not evaluated means the source gave git commits or a range we can't read, so we can't tell which releases are affected. A fixed version beside it is the source’s own claim.

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-5237 is a high vulnerability (CVSS 8.8) in Google Protobuf, published September 25, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.96%, the 92nd percentile. Fixed in Google.Protobuf 3.4.0.

References

Show 67 moreShow less