CVE-2024-53984

Nanopb is a small code-size Protocol Buffers implementation. When the compile time option PB_ENABLE_MALLOC is enabled, the message contains at least one field with FT_POINTER field type, custom stream callback is used with unknown stream length. and the pb_decode_ex() function is used with flag PB_DECODE_DELIMITED, then the pb_decode_ex() function does not automatically call pb_release(), like is done for other failure cases. This could lead to memory leak and potential denial-of-service. This vulnerability is fixed in 0.4.9.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-401",
        "CWE-755"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53984.json"
}

References

Affected packages

Git / github.com/nanopb/nanopb

Affected ranges

Type

GIT

Repo

https://github.com/nanopb/nanopb

Events

Introduced

c29ca83ff47a7224172a74ccfee07d91fa040e4c

Fixed

2b86c255aa52250438d5aba124d0e86db495b378

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.4.0"
        },
        {
            "fixed": "0.4.9.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.4.0

0.4.1

0.4.2

0.4.3

0.4.4

0.4.5

0.4.6

0.4.6.4

0.4.7

0.4.8

0.4.9

nanopb-0.*

nanopb-0.4.0

nanopb-0.4.0-dev

nanopb-0.4.1

nanopb-0.4.2

nanopb-0.4.3

nanopb-0.4.4

nanopb-0.4.5

nanopb-0.4.6

nanopb-0.4.7

nanopb-0.4.8

nanopb-0.4.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-53984.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "133668931834258263763085092036640588701",
                "169821086851512961497746753284745162339",
                "272838966146809958213744410910866871932",
                "65836438945697767567965544224116460321"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-53984-25c544ca",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/nanopb/nanopb/commit/2b86c255aa52250438d5aba124d0e86db495b378",
        "target": {
            "file": "pb_decode.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "234246104478002698156771035608019259976",
            "length": 470
        },
        "id": "CVE-2024-53984-9d21860c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/nanopb/nanopb/commit/2b86c255aa52250438d5aba124d0e86db495b378",
        "target": {
            "file": "pb_decode.c",
            "function": "pb_decode_ex"
        }
    }
]

vanir_signatures_modified

"2026-08-12T15:13:12Z"