GHSA-7gcm-g887-7qv7
protobuf affected by a JSON recursion depth bypass
At a glance
- Published
- Updated
- CVE
- CVE-2026-0994
- Aliases
- PYSEC-2026-1805
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Description
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
Affected packages
| Package | Versions |
|---|---|
| PyPI · protobuf | introduced 6.30.0rc1, fixed 6.33.5 |
| PyPI · protobuf | introduced 0, fixed 5.29.6 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-0994 ADVISORY
- https://github.com/protocolbuffers/protobuf/issues/25070 WEB
- https://github.com/protocolbuffers/protobuf/pull/25239 WEB
- https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf WEB
- https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b WEB
- https://github.com/protocolbuffers/protobuf PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |