The vulnerability CVE-2026-0994 involves uncontrolled recursion in the Python Protobuf library's json_format.ParseDict() function. Specifically, the internal logic handling google.protobuf.Any messages does not account for recursion depth properly, allowing deeply nested Any messages to bypass the intended recursion limit. This leads to exhaustion of Python's recursion stack and triggers a RecursionError, causing a denial-of-service condition. The issue affects all Python Protobuf versions up to and including 33.4. Red Hat has published security advisories (RHSA-2026:3220 and RHSA-2026:3959) that include this vulnerability in their security updates.

An attacker can cause a denial-of-service by supplying maliciously crafted deeply nested protobuf Any messages that bypass the recursion depth limit, leading to a RecursionError and potential application crash or service disruption. This impacts any system using vulnerable versions of Python Protobuf that parse such messages, potentially affecting availability.

Red Hat has released security advisories addressing this vulnerability and recommends applying the provided updates. Users should upgrade Python Protobuf to a version later than 33.4 where this issue is resolved. Since this is not a cloud service, remediation requires updating the affected software. Patch status is not explicitly stated in the input data, so users should consult the vendor advisory for the latest patch information and apply official fixes accordingly.