{"id":"CVE-2021-21401","details":"Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `oneof` directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field is incorrectly treated as if it was a pointer value. Such message data rarely occurs in normal messages, but it is a concern when untrusted data is parsed. This has been fixed in versions 0.3.9.8 and 0.4.5. See referenced GitHub Security Advisory for more information including workarounds.","aliases":["GHSA-7mv5-5mxh-qg88","PYSEC-2021-432"],"modified":"2026-08-18T13:55:36.949728Z","published":"2021-03-23T18:15:13.160Z","related":["openSUSE-SU-2024:11074-1"],"references":[{"type":"ADVISORY","url":"https://github.com/nanopb/nanopb/blob/c9124132a604047d0ef97a09c0e99cd9bed2c818/CHANGELOG.txt#L1"},{"type":"REPORT","url":"https://github.com/nanopb/nanopb/issues/647"},{"type":"FIX","url":"https://github.com/nanopb/nanopb/commit/e2f0ccf939d9f82931d085acb6df8e9a182a4261"},{"type":"FIX","url":"https://github.com/nanopb/nanopb/security/advisories/GHSA-7mv5-5mxh-qg88"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nanopb/nanopb","events":[{"introduced":"0"},{"fixed":"7ee9ef9f627d85cbe1b8c4f49a3ed26eed216c77"},{"introduced":"c29ca83ff47a7224172a74ccfee07d91fa040e4c"},{"fixed":"c9124132a604047d0ef97a09c0e99cd9bed2c818"},{"fixed":"e2f0ccf939d9f82931d085acb6df8e9a182a4261"}],"database_specific":{"cpe":"cpe:2.3:a:nanopb_project:nanopb:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"0.3.9.8"},{"introduced":"0.4.0"},{"fixed":"0.4.5"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["nanopb-0.3.9.7","0.3.9.7","nanopb-0.4.4","0.4.4","nanopb-0.4.3","0.4.3","nanopb-0.3.9.6","0.3.9.6","nanopb-0.4.2","0.4.2","nanopb-0.3.9.5","0.3.9.5","nanopb-0.4.1","0.4.1","nanopb-0.4.0","0.4.0","nanopb-0.3.9.4","0.3.9.4","nanopb-0.3.9.3","0.3.9.3","nanopb-0.3.9.1","0.3.9.1","nanopb-0.4.0-dev","nanopb-0.3.9","0.3.9","nanopb-0.3.8","0.3.8","nanopb-0.3.7","0.3.7","nanopb-0.3.6","0.3.6","nanopb-0.3.5","nanopb-0.3.4","nanopb-0.3.3","nanopb-0.3.2","nanopb-0.3.1","nanopb-0.2.9","nanopb-0.3.0","nanopb-0.2.8","nanopb-0.2.7","nanopb-0.2.6","nanopb-0.2.5","nanopb-0.2.4","nanopb-0.2.3","nanopb-0.2.2","nanopb-0.2.1","nanopb-0.2.0","nanopb-0.1.9","nanopb-0.1.8","nanopb-0.1.7","nanopb-0.1.6","nanopb-0.1.5","nanopb-0.1.4","nanopb-0.1.3","nanopb-0.1.2","nanopb-0.1.1","nanopb-0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-21401.json","vanir_signatures_modified":"2026-08-18T13:55:36Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/nanopb/nanopb/commit/e2f0ccf939d9f82931d085acb6df8e9a182a4261","target":{"file":"pb_decode.c","function":"pb_release_union_field"},"deprecated":false,"digest":{"length":325,"function_hash":"135569156852612219065699278227514311302"},"id":"CVE-2021-21401-1bc41359"},{"digest":{"line_hashes":["61013708987579731352987091476408286170","327087506916403461653276454963703349803","44894250810108914257220512929796472898"],"threshold":0.9},"id":"CVE-2021-21401-ba7b2709","signature_type":"Line","signature_version":"v1","source":"https://github.com/nanopb/nanopb/commit/e2f0ccf939d9f82931d085acb6df8e9a182a4261","target":{"file":"pb_decode.c"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"}]}