AZL-76487
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-76487.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-76487
- Upstream
- Published
- 2026-01-23T15:16:06Z
- Modified
- 2026-04-01T05:22:57.826351Z
- Summary
- CVE-2026-0994 affecting package protobuf for versions less than 3.17.3-5
- Details
-
A denial-of-service (DoS) vulnerability exists in google.protobuf.jsonformat.ParseDict() in Python, where the maxrecursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.
Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
- References