This vulnerability in Python Protobuf's json_format.ParseDict() function allows an attacker to bypass the intended recursion depth limit by crafting deeply nested google.protobuf.Any messages. The internal handling logic does not properly account for recursion depth, leading to uncontrolled recursion that exhausts the Python recursion stack and triggers a RecursionError. This results in a denial-of-service condition. The issue affects all versions up to and including 33.4. Red Hat has released security advisories and errata with patches to remediate this vulnerability.

An attacker can cause a denial-of-service by triggering a RecursionError in Python applications using the affected Protobuf versions. This is achieved by supplying maliciously crafted deeply nested Any messages that bypass the recursion depth limit, leading to exhaustion of the Python recursion stack. There is no indication of privilege escalation, code execution, or data disclosure from this vulnerability.

Fixes for this vulnerability are available as indicated by multiple Red Hat security advisories and errata. Users should apply the relevant updates provided by their vendor or distribution to remediate the issue. Since this is not a cloud service, remediation requires updating the affected Python Protobuf library to a patched version beyond 33.4. Patch status is confirmed by Red Hat advisories linked in the references.