A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.
Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
CVSS Details
- CVSS 4.0 Base Score: 8.2 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade protobufUpgrade protobuf-liteUpgrade protobuf-lite-develUpgrade protobuf-compilerUpgrade python3-protobufUpgrade protobuf-devel | Feb 27, 2026 | Feb 23, 2026 |
| Amazon_linux_2023 | — | Upgrade protobuf-liteUpgrade protobuf-lite-staticUpgrade protobuf-staticUpgrade protobuf-lite-debuginfoUpgrade protobufUpgrade protobuf-compilerUpgrade python3-protobufUpgrade python3-protobuf-debuginfoUpgrade protobuf-debuginfoUpgrade protobuf-vimUpgrade protobuf-emacsUpgrade protobuf-lite-develUpgrade protobuf-debugsourceUpgrade protobuf-compiler-debuginfoUpgrade protobuf-devel | Feb 20, 2026 | Jan 23, 2026 |
| Debian | — | Upgrade protobuf | Jul 12, 2026 | Jul 12, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | May 12, 2026 |
| Oracle_linux | — | Upgrade python3-protobufUpgrade protobuf-develUpgrade protobuf-liteUpgrade protobufUpgrade protobuf-compilerUpgrade protobuf-lite-devel | Feb 24, 2026 | Jan 23, 2026 |
| Redhat_linux | — | Upgrade protobuf-compiler-debuginfoUpgrade protobufUpgrade protobuf-lite-develUpgrade protobuf-liteUpgrade python3-protobuf-debuginfoUpgrade protobuf-develUpgrade protobuf-debuginfoUpgrade protobuf-compilerUpgrade protobuf-lite-debuginfoUpgrade protobuf-debugsourceUpgrade python3-protobuf | Feb 25, 2026 | Jan 23, 2026 |
| Rocky_linux | — | Upgrade protobuf-debuginfoUpgrade protobufUpgrade protobuf-compilerUpgrade protobuf-debugsourceUpgrade protobuf-lite-debuginfoUpgrade protobuf-lite-develUpgrade protobuf-liteUpgrade protobuf-develUpgrade python3-protobuf-debuginfoUpgrade python3-protobufUpgrade protobuf-compiler-debuginfo | Feb 26, 2026 | Feb 24, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.10Upgrade Splunk Enterprise to version 10.2.2Upgrade Splunk Enterprise to version 10.0.5Upgrade Splunk Enterprise to version 9.3.11 | Apr 16, 2026 | Jan 23, 2026 |
| Suse | — | Upgrade libutf8_range-28_3_0Upgrade libprotobuf-lite25_1_0-32bitUpgrade python313-protobufUpgrade python311-protobufUpgrade libprotobuf-lite25_1_0Upgrade libprotoc28_3_0Upgrade libprotoc20Upgrade libprotobuf25_1_0Upgrade libprotobuf25_1_0-32bitUpgrade protobuf-java-javadocUpgrade protobuf-java-bomUpgrade libprotobuf-lite20Upgrade python3-protobufUpgrade libprotoc25_1_0Upgrade protobuf-develUpgrade protobuf-java-parentUpgrade libprotobuf-lite28_3_0Upgrade libprotoc25_1_0-32bitUpgrade protobuf-javaUpgrade libprotobuf28_3_0Upgrade libprotobuf20 | Feb 5, 2026 | Feb 4, 2026 |
| Ubuntu | — | Upgrade libprotobuf17 (Ubuntu Pro)Upgrade python3-protobufUpgrade libprotobuf10 (Ubuntu Pro)Upgrade libprotobuf32t64Upgrade python-protobuf (Ubuntu Pro)Upgrade libprotobuf23Upgrade python3-protobuf (Ubuntu Pro) | Feb 26, 2026 | Jan 23, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 23, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub