Skip to main content

Protobuf CVE-2026-0994

HIGH
Uncontrolled Recursion (CWE-674)
2026-01-23 cve-coordination@google.com GHSA-7gcm-g887-7qv7
Authentication Bypass Python Google Protobuf
8.2
CVSS 4.0 · Vendor: google
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft JSON with nested Any messages
  2. Delivery
    Supply to ParseDict() function
  3. Exploit
    Bypass max_recursion_depth limit
  4. Execution
    Exhaust Python recursion stack
  5. Impact
    Trigger RecursionError denial-of-service

Vulnerability Assessment

Weakness
CWE
CWE-674
Exploitation Conditions

Application uses google.protobuf.json_format.ParseDict() to process untrusted JSON containing google.protobuf.Any message types with recursion depth validation enabled but not enforced in Any-handling logic.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

RemediationAI

Monitor vendor advisories for a patch.

Affected Packages

pypi protobuf fix: 5.29.6, 6.33.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-674 (Uncontrolled Recursion). A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

Know when Protobuf gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (google) PRIMARY 8.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
Low

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Jan 23, 2026 - 15:16 nvd
HIGH 8.2

DescriptionCVE.org

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 19 pypi packages depend on protobuf (9 direct, 12 indirect)

Ecosystem-wide dependent count for version 6.30.0rc1.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact· derived
Medium

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:google:protobuf:*:*:*:*:*:*:*:*

More in Protobuf

View all
CVE-2024-2410 CRITICAL
9.8 May 03

The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a st
CVE-2015-5237 HIGH
8.8 Sep 25

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow. Rated high severity (CVSS 8.8), th
CVE-2024-7254 HIGH
8.7 Sep 19

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGRO
CVE-2021-3121 HIGH
8.6 Jan 11

An issue was discovered in GoGo Protobuf before 1.3.2. Rated high severity (CVSS 8.6), this vulnerability is remotely ex
CVE-2026-104635 HIGH
8.2 Oct 09

Memory-exhaustion denial of service in the elixir-protobuf library (protobuf) from 0.8.0 onward allows an unauthenticate
CVE-2023-24535 HIGH
7.5 Jun 08

Parsing invalid messages can panic. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authe

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2026-66393 HIGH POC
8.7
CVE-2026-18140 HIGH POC
8.7
CVE-2026-93687 HIGH POC
8.7
CVE-2026-9769 HIGH POC
8.7

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/manager/5.0/x86_64/server:latest Container suse/multi-linux-manager/5.1/x86_64/server:5.1.2.8.13.2 Image server-image Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Image SLES15-SP6 Image SLES15-SP6-Azure-3P Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAPCAL-Azure Affected
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 9 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:3059 ADVISORY https://access.redhat.com/errata/RHSA-2026:3094 ADVISORY https://access.redhat.com/errata/RHSA-2026:3095 ADVISORY https://access.redhat.com/errata/RHSA-2026:3097 ADVISORY https://access.redhat.com/errata/RHSA-2026:3218 ADVISORY https://access.redhat.com/errata/RHSA-2026:3219 ADVISORY https://access.redhat.com/errata/RHSA-2026:3220 ADVISORY https://access.redhat.com/errata/RHSA-2026:3461 ADVISORY https://access.redhat.com/errata/RHSA-2026:3462 ADVISORY https://access.redhat.com/errata/RHSA-2026:3958 ADVISORY https://access.redhat.com/errata/RHSA-2026:3959 ADVISORY https://access.redhat.com/errata/RHSA-2026:8746 ADVISORY https://access.redhat.com/errata/RHSA-2026:8747 ADVISORY https://access.redhat.com/errata/RHSA-2026:8748 ADVISORY https://vuldb.com/vuln/342562 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0374/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0517/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0563/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0618/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20352/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20490/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20753/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20907/ REF https://access.redhat.com/errata/RHSA-2026:16174 REF https://access.redhat.com/errata/RHSA-2026:61627 REF https://access.redhat.com/errata/RHSA-2026:61629 REF https://access.redhat.com/security/cve/CVE-2026-0994 REF https://bugzilla.redhat.com/show_bug.cgi?id=2432398 REF https://github.com/protocolbuffers/protobuf/pull/25239 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0994.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy