Tech Support
Documentation
Login
Contact Us
Keep your legacy Linux servers patched and compliant – no risky rebuilds, downtime, hardware upgrades, or added workload.
Endless Lifecycle Support for Protocol Buffers
Security patches for EOL Protocol Buffers in distributed systems and gRPC services
Currently supported versions:
2.5.0
CVE fixes for Protocol Buffers 2.5.0 past end of life. Delivered through your existing package manager. Keep serialization-heavy services and gRPC-dependent applications secure without forcing a protobuf version upgrade.
If It’s Open Source and Not on Our List,
We’re Ready to Support It. Just Ask→
TuxCare keeps you ahead of threats by proactively tracking and patching new CVEs impacting Protobuf. View all security fixes available to date here.
Keep Running.
Skip the Risks.
Upgrading end-of-life Protobuf can be disruptive, resource-intensive, and costly.
TuxCare’s ELS keeps your legacy and EOL components secure, compliant, and stable – without the risks of costly upgrades.
Trusted by
Innovators
Around the World
What Does Endless Lifecycle Support Include?
Rapid CVE Response
Rapid SLA-backed security patches for Protobuf for as long as you need
Complete Coverage
Security fixes for both direct and transitive dependencies in Protobuf AT NO EXTRA COST
Preserved Compatibility
Extensively tested updates designed to work flawlessly with your existing code
Seamless Integration
Plug-and-play integration with your existing workflows and CI/CD pipelines
Secure Distribution
Signed, tamper-proof Protobuf security updates delivered from trusted, TuxCare-hosted repositories
Trusted Support
24/7 expert assistance with Protobuf vulnerability triage, security patch requests, and troubleshooting
Secure Every Layer of Your OSS
Dependency Tree for the Long Run
End-of-life risk rarely lives in your top-level packages. It hides in the transitive
dependencies woven throughout your open-source stack.
When one of those libraries becomes vulnerable, every downstream component
must be rebuilt and validated.
TuxCare automates this entire process – tracking vulnerable EOL
libraries, applying security fixes, and rebuilding dependent components
– ensuring your full dependency chain stays secure and stable.
How Does It Work?
1
We onboard new projects and enable 24/7 automated CVE tracking – monitoring the NVD, vendor, and GitHub security advisories, and other sources.
2
Once CVEs are detected, we backport upstream fixes using algorithmic and AI-assisted automation, with expert validation to ensure accuracy.
3
Patches are compiled in a binary format, extensively tested (for integrity, functionality, and regression), signed, and deployed to ELS repositories.
4
Your package managers, build tools, or orchestrators check for updates, then automatically pull and install them.
Trusted Software Supply Chain
With Endless Lifecycle Support, every release is transparent,
secure, and built to industry standards you can trust.
Software Bill of Materials (SBOM)
Gain complete visibility into the components in each patched release so you always know exactly what is running in your environment.
Vulnerability Exploitability eXchange (VEX) Context
See which vulnerabilities in your SBOM have already been remediated, allowing you to focus attention where action is still required.
SLSA Level 3 Compliance*
Get packages that meet SLSA Level 3 requirements, giving you verifiable assurance of secure sourcing, building, and integrity. * Coming soon
Built for Your Stack
ELS for Protobuf is built to install easily and run with your existing workflows
TuxCare has successfully resolved
more than 14,000 CVEs
in open-source software - keeping enterprise
systems secure and compliant
Need Coverage for Other End-of-Life
Open-Source Components?
TuxCare’s ELS extends security patching to your operating systems, runtimes,
libraries and production apps, keeping your entire open-source stack secure, stable,
and compatible for as long as you need.
Endless Lifecycle Support
for Operating Systems
Endless Lifecycle Support
for Runtimes
Keep your apps running safely on the runtimes they were built for, without rushed upgrades or broken code – even after official support ends.
Endless Lifecycle Support
for Libraries
Keep securely running your apps on EOL libraries – without rushed upgrades, costly code rewrites, or disruption to your roadmap.
Endless Lifecycle Support
for Applications
Ensure your EOL apps stay secure and operational while avoiding outages, broken workflows, and code rewrites.
We’ve Been Powering Enterprise-Grade Patching At
Unprecedented Scale – and We're Just Getting Started
2,700+
Enterprise Clients
70,000+Packages Curated
420,000+
Patches Delivered
14,000+
Vulnerabilities Fixed
11,000+
Kernels Supported
70+
Linux Distro Versions Supported
Why TuxCare?
15 years of proven excellence in open-source patching have created highly
automated processes and systems, providing:
Extensive Coverage of Open-Source Technologies
We provide long-term security across your entire stack, supporting a wide and continually expanding set of open-source projects, libraries, and runtimes – all from a single, trusted partner.
Efficiencies in Build Chains and Testing
We utilize advanced automation across CVE discovery, backporting, building, and release workflows to accelerate delivery and ensure the highest possible quality of security patches.
Identification and Patching of Transitive Dependencies
We go beyond surface-level scanning to uncover and fix hidden vulnerabilities deep in your dependency trees, securing the entire software supply chain with precision and scale.
Fast and Consistent Delivery of Patches with Supporting SLAs
Automated pipelines and mature workflows ensure rapid, reliable patch delivery backed by SLAs – giving you confidence in your risk management and compliance posture.
Frequently Asked Questions
ELS for Protocol Buffers delivers security fixes for older protobuf runtime libraries across several language ecosystems. TuxCare maintains patched builds for Java, Python, PHP and JavaScript (protobufjs), so services that exchange protobuf messages can stay on the versions they were built with.
For Java, protobuf 2.5.0, 2.6.1, 3.6.1, 3.7.1, 3.12.0, 3.16.1, 3.19.2, 3.19.6, 3.21.1, 3.21.7, 3.21.9 and 3.21.12. For Python, 3.17.0, 3.20.3, 4.24.3, 4.25.8 and 4.25.9. For PHP, 3.24.4 and 3.25.9. For JavaScript, selected protobufjs versions from 0.12.13 to 8.0.1. Current lists live on docs.tuxcare.com.
Mostly parsing problems, since protobuf libraries decode untrusted bytes. In Java, CVE-2022-3171 allowed denial of service through crafted messages, and CVE-2024-7254 caused stack exhaustion from deeply nested groups. On the JavaScript side, protobufjs has had prototype pollution issues such as CVE-2023-36665.
Generated protobuf code has to stay compatible with the runtime version. Some runtime upgrades work without regenerating code, but larger version jumps can mean updating generated classes, dependencies and shared tooling across teams, and Hadoop-era Java projects in particular remain tied to protobuf 2.5.0. ELS lets you patch the runtime line you're on without forcing that work.
Through each ecosystem's normal package manager. Java builds pull from a TuxCare Maven repository, Python from a TuxCare-managed index via pip, PHP through a Composer repository, and JavaScript from a TuxCare npm registry. Installation steps for each are on docs.tuxcare.com.
TuxCare targets 14 days from public disclosure for critical and high vulnerabilities, 60 days for medium and 90 days for low. Each ecosystem has a CycloneDX VEX feed at security.tuxcare.com that compatible scanners can use to confirm which CVEs are resolved in the build you deploy.
Generally, no. TuxCare patches the runtime library version you already use rather than moving you to a new release line, so existing generated classes built for that version should keep working. The change is in your dependency configuration, not your schemas or generated sources, though testing before rollout is still good practice.
Talk to a TuxCare Expert
Tell us your challenges, and our experts will help you find the best approach to address them with the TuxCare product line.
