CVE-2026-0994

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-0994
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-0994.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-0994
Aliases
Downstream
AZL (5)
BELL (1)
CGA (142)
CLEANSTART (23)
CLSA (4)
DEBIAN (1)
ECHO (1)
MINI (8)
OESA (1)
openSUSE (2)
RHSA (9)
RLSA (2)
ROOT (1)
SUSE (9)
UBUNTU (1)
Related
ALSA (2)
openSUSE (2)
SUSE (9)
Published
2026-01-23T14:55:16Z
Modified
2026-09-03T03:30:47Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L CVSS Calculator
Summary
Denial of Service in Python Protobuf
Details

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

Database specific 
{
    "cna_assigner":  "Google",
    "cwe_ids":  [
        "CWE-674"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0994.json"
}
References

Affected packages

Git / github.com/protocolbuffers/protobuf

Affected ranges

Type
GIT
Repo
https://github.com/protocolbuffers/protobuf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
edaa823d8b36a8656d7b2b9241b7d0bfe50af878
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:google:protobuf:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "v33.4"
        },
        {
            "last_affected":  "33.4"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

rust-prerelease-4.*
rust-prerelease-4.30.0-beta1
rust-prerelease-4.31.0-beta1
v2.*
v2.6.0
v2.6.1rc1
Other
v26-dev
v27-dev
v28-dev
v29-dev
v30-dev
v31-dev
v32-dev
v33-dev
v3.*
v3.0.0-alpha-3
v3.0.0-alpha-4
v3.0.0-beta-1
v3.0.0-beta-1-bzl-fix
v3.0.0-beta-2
v3.0.0-beta-3-pre-1
v3.12.3
v3.20.0-rc2
v33.*
v33.0-rc1
v33.4
v4.*
v4.33.0-rc1-objectivec
v4.33.4-objectivec

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-0994.json"