The protobuf package in Red Hat Enterprise Linux 9.2 contains a denial of service vulnerability identified as CVE-2026-0994. This vulnerability arises from a recursion depth bypass in the python protobuf implementation, potentially allowing an attacker to cause a denial of service by triggering excessive recursion. Red Hat Product Security has released an update to protobuf-3.14.0-13.el9_2.1 to fix this issue. The advisory rates the security impact as Important. The protobuf library is used for efficient serialization of structured data using Google's Protocol Buffers format. The vulnerability is tracked under CWE-674 (Improper Control of a Resource Through a Logic Error).

Successful exploitation of this vulnerability can lead to a denial of service condition by causing the protobuf library to exceed recursion limits and crash or hang. This could disrupt applications or services relying on protobuf for data serialization. There are no reports of active exploitation in the wild. The impact is limited to denial of service and does not include code execution or data disclosure based on the provided information.

Red Hat has released an updated protobuf package (version 3.14.0-13.el9_2.1) that addresses CVE-2026-0994. Users of affected Red Hat Enterprise Linux 9.2 systems should apply the official update as detailed in Red Hat advisory RHSA-2026:3220. The vendor advisory provides instructions for applying the update. No additional mitigation steps are indicated or required beyond applying the official patch.