{"action":"Upgrade nanopb to 0.3.9.8 or later.","affected":[{"fixed":"0.3.9.8","introduced":"0.3.2"},{"fixed":"0.4.5","introduced":"0.4.0"}],"component":"nanopb","cve_ids":["CVE-2021-21401"],"ecosystem":"PyPI","epss":0.01811,"exploited":false,"fixed_versions":["0.3.9.8","0.4.5"],"ghsa_id":"GHSA-7mv5-5mxh-qg88","id":"tcs_01M5KF69BVD5HRE6N6NQZQ8PKY","modified_at":"2026-07-08T06:28:07.042648156Z","published_at":"2024-08-30T18:45:41Z","references":["https://osv.dev/vulnerability/GHSA-7mv5-5mxh-qg88","https://github.com/nanopb/nanopb/security/advisories/GHSA-7mv5-5mxh-qg88","https://nvd.nist.gov/vuln/detail/CVE-2021-21401","https://github.com/nanopb/nanopb/issues/647","https://github.com/nanopb/nanopb/commit/4a375a560651a86726e5283be85a9231fd0efe9c","https://github.com/nanopb/nanopb/commit/e2f0ccf939d9f82931d085acb6df8e9a182a4261","https://github.com/nanopb/nanopb","https://github.com/nanopb/nanopb/blob/c9124132a604047d0ef97a09c0e99cd9bed2c818/CHANGELOG.txt#L1","https://github.com/pypa/advisory-database/tree/main/vulns/nanopb/PYSEC-2021-432.yaml"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-7mv5-5mxh-qg88","url":"https://osv.dev/vulnerability/GHSA-7mv5-5mxh-qg88"}],"summary":"nanopb vulnerable to invalid free() call with oneofs and PB_ENABLE_MALLOC"}