CVE-2021-21401
CVE-2021-21401 is a high-severity vulnerability in Nanopb Project Nanopb with a CVSS 3.x base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-763.
Key facts
- Severity: High (CVSS 3.x base score 7.1)
- CVSS v2: 5.5
- EPSS exploit prediction: 2% (76th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-763
- Affected product: Nanopb Project Nanopb
- Published:
- Last modified:
Description
Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `oneof` directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field is incorrectly treated as if it was a pointer value. Such message data rarely occurs in normal messages, but it is a concern when untrusted data is parsed. This has been fixed in versions 0.3.9.8 and 0.4.5. See referenced GitHub Security Advisory for more information including workarounds.
Frequently asked questions
- What is CVE-2021-21401?
- Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `oneof` directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field is incorrectly treated as if it was a pointer value. Such message data rarely occurs in normal messages, but it is a concern when untrusted data is parsed. This has been fixed in versions 0.3.9.8 and 0.4.5. See referenced GitHub Security Advisory for more information including workarounds.
- How severe is CVE-2021-21401?
- CVE-2021-21401 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability low.
- Is CVE-2021-21401 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (76th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2021-21401?
- CVE-2021-21401 affects Nanopb Project Nanopb. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2021-21401?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2021-21401 published?
- CVE-2021-21401 was published on 2021-03-23 and last updated on 2026-06-17.
References
- https://github.com/nanopb/nanopb/blob/c9124132a604047d0ef97a09c0e99cd9bed2c818/CHANGELOG.txt#L1
- https://github.com/nanopb/nanopb/commit/e2f0ccf939d9f82931d085acb6df8e9a182a4261
- https://github.com/nanopb/nanopb/issues/647
- https://github.com/nanopb/nanopb/security/advisories/GHSA-7mv5-5mxh-qg88
Affected products (1)
- cpe:2.3:a:nanopb_project:nanopb:*:*:*:*:*:*:*:*
More vulnerabilities in Nanopb Project Nanopb
- CVE-2014-125106 — Critical (CVSS 9.8): Nanopb before 0.3.1 allows size_t overflows in pb_dec_bytes and pb_dec_string.
- CVE-2020-26243 — High (CVSS 7.5): Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding…
- CVE-2020-5235 — Medium (CVSS 6.5): There is a potentially exploitable out of memory condition In Nanopb before 0.4.1, 0.3.9.5, and 0.2.9.4. When nanopb is…
All CVEs affecting Nanopb Project Nanopb →
Other CWE-763 vulnerabilities
- CVE-2026-52993 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in…
- CVE-2025-14233 — Critical (CVSS 9.8): Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may…
- CVE-2024-44852 — Critical (CVSS 9.8): Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a segmentation violation…
- CVE-2021-42377 — Critical (CVSS 9.8): An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution…
- CVE-2021-30473 — Critical (CVSS 9.8): aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.
- CVE-2021-24028 — Critical (CVSS 9.8): An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code…