Debian Patches

Status for protobuf/3.21.12-3+deb12u1

Patch Description Author Forwarded Bugs Origin Last update
CVE-2025-4565-1.patch Make Pure Python reject unmatched end-group tag in unknown fields

This brings it into conformance with our spec and other languages.		 Mike Kruskal <mkruskal@google.com> yes debian upstream upstream, https://github.com/protocolbuffers/protobuf/commit/f69ea1cc48191534c3450a1053f3741250274eca.patch 2024-12-09
CVE-2025-4565-2.patch Internal pure python fixes Protobuf Team Bot <protobuf-github-bot@google.com> yes debian upstream upstream, https://github.com/protocolbuffers/protobuf/commit/a6fa5799ff0153e4f0f6f1d8263d6b492ac129e0.patch 2025-03-04
CVE-2025-4565-3.patch Add recursion depth limits to pure python Protobuf Team Bot <protobuf-github-bot@google.com> yes debian upstream upstream, https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901.patch 2025-05-13
build_32_bit_tests.patch Adding full build to 32 bit tests (#10589)
* Adding full build to 32 bit tests

* Running C++ tests in 32 bit builds

* Patching static assert test failure

* Test fixes for 32-bit architectures

* Cleanup after CMake build

* Save protoc before cleanup

* Route protoc better		 Mike Kruskal <62662355+mkruskal-google@users.noreply.github.com> no 2022-09-19
fix_C++_32bit_tests.patch fix C++ build tests Add bits to expect 32 bit systems. Laszlo Boszormenyi (GCS) <gcs@debian.org> no debian 2023-04-07
fix_Python_32bit_tests.patch fix Python build tests Add bits to expect 32 bit systems. Laszlo Boszormenyi (GCS) <gcs@debian.org> no debian 2023-04-07
CVE-2024-7254-1.patch [PATCH 1/5] Internal change Protobuf Team Bot <protobuf-github-bot@google.com> no 2024-08-16
CVE-2024-7254-2.patch [PATCH 2/5] Internal change Protobuf Team Bot <protobuf-github-bot@google.com> no 2024-07-18
CVE-2024-7254-3.patch [PATCH 3/5] Add recursion check when parsing unknown fields in Java. Protobuf Team Bot <protobuf-github-bot@google.com> no 2024-09-17
CVE-2024-7254-4.patch [PATCH 4/5] Fix merge conflict by adding optional label to proto2 unittest_lite.proto Sandy Zhang <sandyzhang@google.com> no 2024-09-18
CVE-2024-7254-5.patch [PATCH 5/5] Remove RecursiveGroup test case which doesn't exist in 25.x pre-Editions Sandy Zhang <sandyzhang@google.com> no 2024-09-18
no_j2objc.patch Remove dependency on j2objc library It's not needed for Debian. Laszlo Boszormenyi (GCS) <gcs@debian.org> not-needed 2022-03-11
no_javax.patch Remove dependency on javax.annotation library It's not yet packaged and not mandatory. Laszlo Boszormenyi (GCS) <gcs@debian.org> not-needed 2022-03-11
Fix_build_with_Python_3.11.patch Fix build with Python 3.11
The PyFrameObject structure members have been removed from the public C API.		 Alexander Shadchin <alexandr.shadchin@gmail.com> no 2022-08-14
fix_hppa_alignof_assert.patch hppa is over aligned and fails Filter out hppa machines on the static_assert lines. Laszlo Boszormenyi (GCS) <gcs@debian.org> no 2023-04-09
Fix_rule_for_java_target.patch Fix rule for java target in examples/Makefile Kiyoshi Mizumaru <kiyoshi.mizumaru@gmail.com> no 2022-08-06
hurd.patch Add support for GNU/Hurd which doesn't define PATH_MAX. Bas Couwenberg <sebastic@debian.org> no debian 2022-03-11
default_python_version =================================================================== no
s390x.patch Add support for s390x architecture. Based on port of Google V8 JavaScript engine to z Systems Sebastiaan Couwenberg <sebastic@xs4all.nl> no debian https://github.com/ibmruntimes/v8z
disable_local_gmock.patch use packaged Google Test and Google Mock libraries Link tests with the already compiled libraries. Laszlo Boszormenyi (GCS) <gcs@debian.org> not-needed 2022-03-11
fix_google_test_link.patch fix linking with recent Google's C++ test framework Need to link with libgtest_main.a as well. Laszlo Boszormenyi (GCS) <gcs@debian.org> no 2022-03-11
no_thirdparty.patch don't compile third_party source . Laszlo Boszormenyi (GCS) <gcs@debian.org> not-needed 2022-09-28
x32.patch fix FTBFS on x32 due to versioned glibc symbols protobuf assumes that glibc 2.2.5 memcpy symbols will be available #if
defined(__x86-64__); however, x32 also defines this, but was not
supported prior to 2.16.		 Laurence Parry <greenreaper@gmail.com> not-needed debian other, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931503#5 2022-03-11
32bit.patch cut number 32 bit number parsing in Python 2 self-tests Any number get back as zero. :-/ Laszlo Boszormenyi (GCS) <gcs@debian.org> no 2022-03-11
python3ify_examples.patch execute examples with Pyhton 3 Update shebang to call Python 3 binary. Laszlo Boszormenyi (GCS) <gcs@debian.org> no 2020-03-24
no_errorprone.patch Remove dependency on errror-prone library Library is not necessary and is not currently available in Debian. This patch
can be safely removed if the error-prone library is ever added to Debian and
that functionality is needed in protobuf.		 Olek Wojnar <olek@debian.org> no 2022-03-11
0001-Fix-Any-recursion-depth-bypass-in-Python-json_format.patch Fix Any recursion depth bypass in Python json_format.ParseDict (#25239) (#25587)

This fixes a security vulnerability where nested google.protobuf.Any messages could bypass the max_recursion_depth limit, potentially leading to denial of service via stack overflow.

The root cause was that _ConvertAnyMessage() was calling itself recursively via methodcaller() for nested well-known types, bypassing the recursion depth tracking in ConvertMessage().

The fix routes well-known type parsing through ConvertMessage() to ensure proper recursion depth accounting for all message types including nested Any.

Fixes #25070

Closes #25239

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/25239 from aviralgarg05:fix-any-recursion-depth-bypass 3cbbcbea142593d3afd2ceba2db14b05660f62f4		 zhangskz <sandyzhang@google.com> no 2026-01-29
0002-Check-that-readRaw-does-not-accept-negative-length-v.patch Check that `readRaw` does not accept negative length value.
Fixes https://github.com/protocolbuffers/protobuf/issues/24159		 Protobuf Team Bot <protobuf-github-bot@google.com> no 2026-01-13
0003-php-Fix-that-recursion-limit-is-not-enforced.patch php: Fix that recursion limit is not enforced.
https://github.com/protocolbuffers/protobuf/issues/25067		 Protobuf Team Bot <protobuf-github-bot@google.com> no 2026-01-14

All known versions for source package 'protobuf'

Links