~ / search / GHSA-7gcm-g887-7qv7

GHSA-7gcm-g887-7qv7

protobuf affected by a JSON recursion depth bypass

Source: GitHub Advisory Database (reviewed) High CVE-2026-0994

Packages

EcosystemPackageAffectedFixed in
PyPI protobuf >= 6.30.0rc1, < 6.33.5 6.33.5
PyPI protobuf < 5.29.6 5.29.6

Details

As written in the advisory (Markdown source, shown as plain text).

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

References

External links from the advisory. They lead to third-party sites.