Name: CVE-2026-0994: Uncontrolled Recursion
Creator: Rapid7
Published: 2026-01-23T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-0994, CWE-674, CVSS 7.5, EPSS 0.00712

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

CVSS Details

CVSS 4.0 Base Score: 8.2 (HIGH)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade python3-protobufUpgrade protobuf-compilerUpgrade protobuf-develUpgrade protobufUpgrade protobuf-liteUpgrade protobuf-lite-devel	Feb 27, 2026	Feb 23, 2026
Amazon_linux_2023	—	Upgrade protobuf-lite-develUpgrade protobuf-emacsUpgrade protobuf-debugsourceUpgrade protobuf-compiler-debuginfoUpgrade protobuf-develUpgrade protobuf-debuginfoUpgrade protobuf-vimUpgrade protobuf-compilerUpgrade protobuf-lite-staticUpgrade protobuf-staticUpgrade protobufUpgrade protobuf-lite-debuginfoUpgrade protobuf-liteUpgrade python3-protobufUpgrade python3-protobuf-debuginfo	Feb 20, 2026	Jan 23, 2026
Debian	—	Upgrade protobuf	Jul 12, 2026	Jul 12, 2026
Nutanix Ahv	—	Upgrade Nutanix AHV to the latest version	Jun 5, 2026	May 12, 2026
Oracle_linux	—	Upgrade python3-protobufUpgrade protobuf-develUpgrade protobuf-liteUpgrade protobuf-lite-develUpgrade protobufUpgrade protobuf-compiler	Feb 24, 2026	Jan 23, 2026
Redhat_linux	—	Upgrade protobufUpgrade protobuf-lite-develUpgrade protobuf-liteUpgrade protobuf-compiler-debuginfoUpgrade python3-protobufUpgrade protobuf-debugsourceUpgrade protobuf-lite-debuginfoUpgrade protobuf-develUpgrade protobuf-compilerUpgrade protobuf-debuginfoUpgrade python3-protobuf-debuginfo	Feb 25, 2026	Jan 23, 2026
Rocky_linux	—	Upgrade protobuf-liteUpgrade protobuf-lite-debuginfoUpgrade protobuf-develUpgrade protobuf-compilerUpgrade protobufUpgrade protobuf-debugsourceUpgrade protobuf-debuginfoUpgrade protobuf-lite-develUpgrade python3-protobufUpgrade python3-protobuf-debuginfoUpgrade protobuf-compiler-debuginfo	Feb 26, 2026	Feb 24, 2026
Splunk	—	Upgrade Splunk Enterprise to version 10.0.5Upgrade Splunk Enterprise to version 9.3.11Upgrade Splunk Enterprise to version 9.4.10Upgrade Splunk Enterprise to version 10.2.2	Apr 16, 2026	Jan 23, 2026
Suse	—	Upgrade libprotobuf-lite28_3_0Upgrade libprotobuf28_3_0Upgrade libprotoc25_1_0-32bitUpgrade protobuf-java-bomUpgrade protobuf-develUpgrade libprotobuf-lite20Upgrade protobuf-java-javadocUpgrade protobuf-java-parentUpgrade python3-protobufUpgrade libprotoc25_1_0Upgrade protobuf-javaUpgrade libprotobuf20Upgrade libutf8_range-28_3_0Upgrade libprotoc20Upgrade python313-protobufUpgrade libprotobuf25_1_0-32bitUpgrade libprotobuf25_1_0Upgrade libprotobuf-lite25_1_0Upgrade libprotoc28_3_0Upgrade libprotobuf-lite25_1_0-32bitUpgrade python311-protobuf	Feb 5, 2026	Feb 4, 2026
Ubuntu	—	Upgrade python3-protobufUpgrade libprotobuf17 (Ubuntu Pro)Upgrade python3-protobuf (Ubuntu Pro)Upgrade libprotobuf10 (Ubuntu Pro)Upgrade libprotobuf32t64Upgrade python-protobuf (Ubuntu Pro)Upgrade libprotobuf23	Feb 26, 2026	Jan 23, 2026
Vmware Photon_os	—	Use 'tdnf update' to upgrade all packages to the latest version.	May 27, 2026	Jan 23, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence