# CVE-2015-5237: Google Protobuf heap buffer overflow

Source: https://junglewise.ai/threats/cve-2015-5237-google-protobuf-heap-buffer-overflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-13. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2015-5237 · Severity: high · CVSS 8.8 · Published 2022-05-13

Google Protobuf, a widely used library for serializing structured data, is vulnerable to a memory corruption issue. An authenticated attacker could exploit this flaw to cause a system crash or potentially execute unauthorized commands. This could lead to service outages or the compromise of sensitive data in applications that rely on this library.

Technologies: [Google Protobuf](https://junglewise.ai/threats/technologies/protobuf), [protobuf (PyPI)](https://junglewise.ai/threats/technologies/pypi-protobuf). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Google](https://junglewise.ai/threats/vendors/google), [Maven](https://junglewise.ai/threats/vendors/maven), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2015-5237 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-5237 being exploited in the wild.

**How severe is CVE-2015-5237?** High severity, with a CVSS score of 8.8, published 13 May 2022.

**Which products and versions are affected?** github.com/protocolbuffers/protobuf (Go) SEMVER:introduced=0,fixed=3.4.0; Google Protobuf < 3.4.0; com.google.protobuf:protobuf-parent (Maven) ECOSYSTEM:introduced=0,fixed=3.4.0; protobuf (PyPI) ECOSYSTEM:introduced=0,fixed=3.1.0.post1, ECOSYSTEM:introduced=0,fixed=3.4.0.

**Is there a fix for CVE-2015-5237?** Yes. github.com/protocolbuffers/protobuf (Go): upgrade to 3.4.0 or later; com.google.protobuf:protobuf-parent (Maven): upgrade to 3.4.0 or later; protobuf (PyPI): upgrade to 3.1.0.post1, 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2015-5237 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2015-5237?** Check whether you run github.com/protocolbuffers/protobuf (Go), Google Protobuf, com.google.protobuf:protobuf-parent (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/protocolbuffers/protobuf (Go): upgrade to 3.4.0 or later

  ```sh
  go get github.com/protocolbuffers/protobuf@v3.4.0
  ```

- com.google.protobuf:protobuf-parent (Maven): upgrade to 3.4.0 or later

  ```sh
  # set com.google.protobuf:protobuf-parent to 3.4.0 in your pom.xml or build.gradle
  ```

- protobuf (PyPI): upgrade to 3.1.0.post1, 3.4.0 or later

  ```sh
  pip install "protobuf>=3.4.0"
  ```


## Technical details

A heap-based buffer overflow vulnerability (CWE-787) exists in Google Protobuf versions prior to 3.4.0. The flaw allows a remote authenticated attacker to trigger an out-of-bounds write by sending crafted input to an application utilizing the library. This can result in a denial-of-service (DoS) condition or potentially arbitrary code execution on the host system. The vulnerability affects multiple language implementations including C++, Java, Python, and Go. Users are advised to upgrade to version 3.4.0 or later to remediate the issue.

## Affected products

- Google Google.Protobuf < 3.4.0
- Google protobuf < 3.4.0

## Identifiers

- CVE-2015-5237
- GHSA-jwvw-v7c5-m82h
- PYSEC-2017-150
- PYSEC-2017-65

## Timeline

- 2015-08-27: disclosed: Initial public disclosure via oss-security mailing list
- 2017-08-15: patched: Version 3.4.0 released fixing the issue
- 2022-05-13: advisory: GitHub Advisory published

## References

- [https://github.com/google/protobuf/issues/760](https://github.com/google/protobuf/issues/760)
- [https://bugzilla.redhat.com/show_bug.cgi?id=1256426](https://bugzilla.redhat.com/show_bug.cgi?id=1256426)
- [https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E](https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E)
- [https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E](https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E)
- [https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E](https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E)

## Related threats

- [PYSEC-2026-1806 - protobuf-python has a potential Denial of Service issue](https://junglewise.ai/threats/cve-2025-4565-protobuf-python-has-a-potential-denial-of-service-issue)
- [PYSEC-2026-899 - protobuf-cpp and protobuf-python have potential Denial of Service issue](https://junglewise.ai/threats/cve-2022-1941-protobuf-cpp-and-protobuf-python-have-potential-denial-of-service)
- [Google Protobuf DoS via negative varints or deep recursion in PHP](https://junglewise.ai/threats/cve-2026-6409-google-protobuf-dos-via-negative-varints-or-deep-recursion-in-php)
- [Google Protobuf denial of service in Python json_format.ParseDict](https://junglewise.ai/threats/cve-2026-0994-google-protobuf-denial-of-service-in-python-json-format-parsedict)
- [Withdrawn Advisory: NULL Pointer Dereference in Protocol Buffers](https://junglewise.ai/threats/cve-2021-22570-withdrawn-advisory-null-pointer-dereference-in-protocol-buffers)