{"action":"Upgrade nanopb to 0.4.4-2 or later.","affected":[{"fixed":"0.4.4-2","introduced":"0"}],"component":"nanopb","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["0.4.4-2"],"id":"tcs_01M5NFDKP972WJM64DB1CGZAA9","modified_at":"2026-10-23T18:03:49.073247946Z","published_at":"2021-03-23T18:15:13.160Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2021-21401","https://security-tracker.debian.org/tracker/CVE-2021-21401"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2021-21401#Debian:14/nanopb","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2021-21401"}],"summary":"Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` cal"}