A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.
Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
CVSS Details
- CVSS 4.0 Base Score: 8.2 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade protobuf-compilerUpgrade protobuf-develUpgrade python3-protobufUpgrade protobufUpgrade protobuf-liteUpgrade protobuf-lite-devel | Feb 27, 2026 | Feb 23, 2026 |
| Amazon_linux_2023 | — | Upgrade protobuf-liteUpgrade protobuf-staticUpgrade protobuf-lite-debuginfoUpgrade protobufUpgrade python3-protobufUpgrade protobuf-lite-staticUpgrade protobuf-compilerUpgrade protobuf-debuginfoUpgrade protobuf-vimUpgrade python3-protobuf-debuginfoUpgrade protobuf-lite-develUpgrade protobuf-emacsUpgrade protobuf-debugsourceUpgrade protobuf-compiler-debuginfoUpgrade protobuf-devel | Feb 20, 2026 | Jan 23, 2026 |
| Debian | — | Upgrade protobuf | Jul 12, 2026 | Jul 12, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | May 12, 2026 |
| Oracle_linux | — | Upgrade protobuf-develUpgrade python3-protobufUpgrade protobuf-liteUpgrade protobufUpgrade protobuf-compilerUpgrade protobuf-lite-devel | Feb 24, 2026 | Jan 23, 2026 |
| Redhat_linux | — | Upgrade python3-protobufUpgrade protobuf-lite-debuginfoUpgrade protobuf-compilerUpgrade protobuf-debuginfoUpgrade python3-protobuf-debuginfoUpgrade protobuf-develUpgrade protobuf-debugsourceUpgrade protobufUpgrade protobuf-compiler-debuginfoUpgrade protobuf-lite-develUpgrade protobuf-lite | Feb 25, 2026 | Jan 23, 2026 |
| Rocky_linux | — | Upgrade protobuf-compilerUpgrade protobuf-lite-debuginfoUpgrade protobuf-develUpgrade protobufUpgrade protobuf-lite-develUpgrade protobuf-debuginfoUpgrade protobuf-debugsourceUpgrade protobuf-liteUpgrade python3-protobufUpgrade protobuf-compiler-debuginfoUpgrade python3-protobuf-debuginfo | Feb 26, 2026 | Feb 24, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.2.2Upgrade Splunk Enterprise to version 9.4.10Upgrade Splunk Enterprise to version 9.3.11Upgrade Splunk Enterprise to version 10.0.5 | Apr 16, 2026 | Jan 23, 2026 |
| Suse | — | Upgrade libprotobuf25_1_0-32bitUpgrade python311-protobufUpgrade python313-protobufUpgrade libprotoc28_3_0Upgrade libprotoc20Upgrade libprotobuf-lite25_1_0-32bitUpgrade libprotobuf-lite25_1_0Upgrade libutf8_range-28_3_0Upgrade libprotobuf25_1_0Upgrade libprotobuf-lite20Upgrade protobuf-java-bomUpgrade libprotobuf28_3_0Upgrade libprotobuf-lite28_3_0Upgrade protobuf-java-javadocUpgrade protobuf-java-parentUpgrade python3-protobufUpgrade protobuf-javaUpgrade protobuf-develUpgrade libprotoc25_1_0-32bitUpgrade libprotoc25_1_0Upgrade libprotobuf20 | Feb 5, 2026 | Feb 4, 2026 |
| Ubuntu | — | Upgrade python3-protobufUpgrade libprotobuf17 (Ubuntu Pro)Upgrade libprotobuf32t64Upgrade libprotobuf10 (Ubuntu Pro)Upgrade python3-protobuf (Ubuntu Pro)Upgrade python-protobuf (Ubuntu Pro)Upgrade libprotobuf23 | Feb 26, 2026 | Jan 23, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 23, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub