Skip to main content
CVE-2026-0994VulnerabilityPublished 02/24/2026Updated 10/08/2026

security update for protobuf

Affects SUSE Product Security Team SUSESource GCVE Database

0

Not known to be exploited · fixed in 0.30.5_1 : patch SUSE Product Security Team SUSE soon.

Data as of 10/25/2026, 07:59:03 UTC

Severity
High

Rated by Threat Radar · No CVSS score from NVD or the CNA

Exploitation

Not in CISA KEV, no exploitation reported

EPSS
0.7% chance of exploitation in 30 days – higher than 53% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available – fixed in 0.30.5_1, 9.0.11_1

What to do

Affected software

ProductAffectedFixed in
Homebrewmlx-lmpkg:brew/mlx-lmOther threatsAffected
  • >=0.28.1 <0.30.5_1
Fixed in
  • 0.30.5_1
Homebrewparsedmarcpkg:brew/parsedmarcOther threatsAffected
  • >=8.11.0 <9.0.11_1
Fixed in
  • 9.0.11_1

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Red Hat has released security advisories addressing this vulnerability and recommends applying the provided updates. Users should upgrade Python Protobuf to a version later than 33.4 where this issue is resolved. Since this is not a cloud service, remediation requires updating the affected software. Patch status is not explicitly stated in the input data, so users should consult the vendor advisory for the latest patch information and apply official fixes accordingly.

Description

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

Impact

An attacker can cause a denial-of-service by supplying maliciously crafted deeply nested protobuf Any messages that bypass the recursion depth limit, leading to a RecursionError and potential application crash or service disruption. This impacts any system using vulnerable versions of Python Protobuf that parse such messages, potentially affecting availability.

Weaknesses

References

Community reviews

Loading reviews…