A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.
Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
CVSS Details
- CVSS 4.0 Base Score: 8.2 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-protobufUpgrade protobuf-compilerUpgrade protobuf-develUpgrade protobufUpgrade protobuf-liteUpgrade protobuf-lite-devel | Feb 27, 2026 | Feb 23, 2026 |
| Amazon_linux_2023 | — | Upgrade protobuf-lite-develUpgrade protobuf-emacsUpgrade protobuf-debugsourceUpgrade protobuf-compiler-debuginfoUpgrade protobuf-develUpgrade protobuf-debuginfoUpgrade protobuf-vimUpgrade protobuf-compilerUpgrade protobuf-lite-staticUpgrade protobuf-staticUpgrade protobufUpgrade protobuf-lite-debuginfoUpgrade protobuf-liteUpgrade python3-protobufUpgrade python3-protobuf-debuginfo | Feb 20, 2026 | Jan 23, 2026 |
| Debian | — | Upgrade protobuf | Jul 12, 2026 | Jul 12, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | May 12, 2026 |
| Oracle_linux | — | Upgrade python3-protobufUpgrade protobuf-develUpgrade protobuf-liteUpgrade protobuf-lite-develUpgrade protobufUpgrade protobuf-compiler | Feb 24, 2026 | Jan 23, 2026 |
| Redhat_linux | — | Upgrade protobufUpgrade protobuf-lite-develUpgrade protobuf-liteUpgrade protobuf-compiler-debuginfoUpgrade python3-protobufUpgrade protobuf-debugsourceUpgrade protobuf-lite-debuginfoUpgrade protobuf-develUpgrade protobuf-compilerUpgrade protobuf-debuginfoUpgrade python3-protobuf-debuginfo | Feb 25, 2026 | Jan 23, 2026 |
| Rocky_linux | — | Upgrade protobuf-liteUpgrade protobuf-lite-debuginfoUpgrade protobuf-develUpgrade protobuf-compilerUpgrade protobufUpgrade protobuf-debugsourceUpgrade protobuf-debuginfoUpgrade protobuf-lite-develUpgrade python3-protobufUpgrade python3-protobuf-debuginfoUpgrade protobuf-compiler-debuginfo | Feb 26, 2026 | Feb 24, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.0.5Upgrade Splunk Enterprise to version 9.3.11Upgrade Splunk Enterprise to version 9.4.10Upgrade Splunk Enterprise to version 10.2.2 | Apr 16, 2026 | Jan 23, 2026 |
| Suse | — | Upgrade libprotobuf-lite28_3_0Upgrade libprotobuf28_3_0Upgrade libprotoc25_1_0-32bitUpgrade protobuf-java-bomUpgrade protobuf-develUpgrade libprotobuf-lite20Upgrade protobuf-java-javadocUpgrade protobuf-java-parentUpgrade python3-protobufUpgrade libprotoc25_1_0Upgrade protobuf-javaUpgrade libprotobuf20Upgrade libutf8_range-28_3_0Upgrade libprotoc20Upgrade python313-protobufUpgrade libprotobuf25_1_0-32bitUpgrade libprotobuf25_1_0Upgrade libprotobuf-lite25_1_0Upgrade libprotoc28_3_0Upgrade libprotobuf-lite25_1_0-32bitUpgrade python311-protobuf | Feb 5, 2026 | Feb 4, 2026 |
| Ubuntu | — | Upgrade python3-protobufUpgrade libprotobuf17 (Ubuntu Pro)Upgrade python3-protobuf (Ubuntu Pro)Upgrade libprotobuf10 (Ubuntu Pro)Upgrade libprotobuf32t64Upgrade python-protobuf (Ubuntu Pro)Upgrade libprotobuf23 | Feb 26, 2026 | Jan 23, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 23, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub