CVE-2026-0994: Denial of Service in Python Protobuf
A denial-of-service (DoS) vulnerability exists in google.protobuf.jsonformat.ParseDict() in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/protobufto a version that resolves this vulnerability.Fixed in 6.33.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0994?
CVE-2026-0994 has a medium severity rating due to its potential to cause denial of service.
How do I fix CVE-2026-0994?
To mitigate CVE-2026-0994, update the protobuf package to version 6.34 or later.
Which versions of protobuf are affected by CVE-2026-0994?
CVE-2026-0994 affects protobuf versions up to and including 6.33.4.
What kind of attack does CVE-2026-0994 facilitate?
CVE-2026-0994 can be leveraged to execute denial of service attacks through excessive recursion in parsing nested messages.
Is there a workaround for CVE-2026-0994 if I can't update immediately?
If an update is not possible, avoid parsing deeply nested google.protobuf.Any messages to reduce the risk of hitting the recursion limit.