> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cockroachlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Technical Advisory 58932

Publication date: February 2, 2021

## Description

A bug in the [protobuf](https://github.com/gogo/protobuf) binary decode functions makes it possible to crash a CockroachDB node by sending a specially crafted HTTP request. This bug can be triggered even without an authenticated session to the DB console.

## Statement

This is resolved by a fix in CockroachDB which fixes the decoding routine of protobuf payloads.

The fix has been applied to maintenance releases of CockroachDB v19.2, v20.1, and v21.1.

## Mitigation

Users of CockroachDB v19.2, v20.1, or v20.2 are invited to upgrade to v19.2.12, v20.1.11, v20.2.4, or a later version. When upgrading is not an option, users should audit their network configuration to verify that the CockroachDB HTTP port is not available to untrusted clients. We recommend blocking the HTTP port behind a firewall.

## Impact

This bug constitutes a security vulnerability, as an attacker can use it to cause full-cluster unavailability. This vulnerability in protobuf is known as [CVE-2021-3121](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121). All versions of CockroachDB up to and including v19.2.11, v20.1.10, and v20.2.3 are affected.

## Notes

Questions about any technical alert can be directed to our [Support team](https://support.cockroachlabs.com/).

We thank Kirk Baird for reporting this issue to Cockroach Labs.