Package
rust-analyzer
Component
protobuf
Latest update
Fixed version
20260427-r0
5.9
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
20260427-r0Status
Impact
The package explicitly pins protobuf to version 3.2.0 in all upstream releases. To remediate the CVE, upstream must bump the protobuf dependency to at least version 3.7.2. Once upstream integrates this update, we can propagate the change and update our package accordingly.
Status
Status
Impact
rust-analyzer depends on scip 0.3.3 which depends on protobuf 3.2.0. scip will need to address https://github.com/sourcegraph/scip/issues/312 then the chain of dependencies will need to cut releases.
Status