PYSEC-2026-1805
protobuf affected by a JSON recursion depth bypass
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-0994
- Alias
- GHSA-7gcm-g887-7qv7
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Description
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · protobuf | introduced 0, fixed 5.29.6, introduced 6.30.0rc1, fixed 6.33.5 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2026-0994 ADVISORY
- https://github.com/protocolbuffers/protobuf/issues/25070 WEB
- https://github.com/protocolbuffers/protobuf/pull/25239 WEB
- https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf WEB
- https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b WEB
- https://github.com/protocolbuffers/protobuf PACKAGE
- https://pypi.org/project/protobuf PACKAGE
- https://github.com/advisories/GHSA-7gcm-g887-7qv7 ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |