CVE-2026-0994

Description

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

References

https://github.com/Vardhan0257/upb-any-recursion-audit

https://github.com/advisories/GHSA-7gcm-g887-7qv7

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0994.json

https://github.com/protocolbuffers/protobuf/pull/25239

https://bugzilla.redhat.com/show_bug.cgi?id=2432398

https://access.redhat.com/security/cve/CVE-2026-0994

https://access.redhat.com/errata/RHSA-2026:8748

https://access.redhat.com/errata/RHSA-2026:8747

https://access.redhat.com/errata/RHSA-2026:8746

https://access.redhat.com/errata/RHSA-2026:61629

https://access.redhat.com/errata/RHSA-2026:61627

https://access.redhat.com/errata/RHSA-2026:3959

https://access.redhat.com/errata/RHSA-2026:3958

https://access.redhat.com/errata/RHSA-2026:3462

https://access.redhat.com/errata/RHSA-2026:3461

https://access.redhat.com/errata/RHSA-2026:3220

https://access.redhat.com/errata/RHSA-2026:3219

https://access.redhat.com/errata/RHSA-2026:3218

https://access.redhat.com/errata/RHSA-2026:3097

https://access.redhat.com/errata/RHSA-2026:3095

https://access.redhat.com/errata/RHSA-2026:3094

https://access.redhat.com/errata/RHSA-2026:3059

https://access.redhat.com/errata/RHSA-2026:16174

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS