{"action":"Upgrade nanopb to 0.3.9.8 or later.","affected":[{"fixed":"0.3.9.8","introduced":"0"},{"fixed":"0.4.5","introduced":"0.4.0"}],"component":"nanopb","cve_ids":["CVE-2021-21401"],"ecosystem":"PyPI","epss":0.01811,"exploited":false,"fixed_versions":["0.3.9.8","0.4.5"],"ghsa_id":"GHSA-7mv5-5mxh-qg88","id":"tcs_01M5KGD0X5QZH9FYM27GQ3PG74","modified_at":"2023-11-08T04:04:44.596402Z","published_at":"2021-03-23T18:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-432","https://github.com/nanopb/nanopb/security/advisories/GHSA-7mv5-5mxh-qg88","https://github.com/nanopb/nanopb/commit/e2f0ccf939d9f82931d085acb6df8e9a182a4261","https://github.com/nanopb/nanopb/issues/647","https://github.com/nanopb/nanopb/blob/c9124132a604047d0ef97a09c0e99cd9bed2c818/CHANGELOG.txt#L1"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-432","url":"https://osv.dev/vulnerability/PYSEC-2021-432"}],"summary":"Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` cal"}