Log in Start free

Vulnerability · Published Jan 23, 2026 · Assigned by Google

CVE-2026-0994Denial of Service in Python Protobuf

High 7.5

In plain English

A high-severity security flaw in Protobuf from Python. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 46.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10protobuf3.19.6-15.el10_1ALSA-2026:3094
AlmaLinux:9protobuf3.14.0-17.el9_7ALSA-2026:3095
AlmaLinux:10protobuf-compiler3.19.6-15.el10_1ALSA-2026:3094
AlmaLinux:9protobuf-compiler3.14.0-17.el9_7ALSA-2026:3095
AlmaLinux:10protobuf-devel3.19.6-15.el10_1ALSA-2026:3094
AlmaLinux:9protobuf-devel3.14.0-17.el9_7ALSA-2026:3095
AlmaLinux:10protobuf-lite3.19.6-15.el10_1ALSA-2026:3094
AlmaLinux:9protobuf-lite3.14.0-17.el9_7ALSA-2026:3095
AlmaLinux:10protobuf-lite-devel3.19.6-15.el10_1ALSA-2026:3094
AlmaLinux:9protobuf-lite-devel3.14.0-17.el9_7ALSA-2026:3095
AlmaLinux:10python3-protobuf3.19.6-15.el10_1ALSA-2026:3094
AlmaLinux:9python3-protobuf3.14.0-17.el9_7ALSA-2026:3095
Debian:12protobuf3.21.12-3+deb12u1DEBIAN-CVE-2026-0994
Debian:13protobuf3.21.12-11+deb13u1DEBIAN-CVE-2026-0994
Debian:14protobuf3.21.12-16DEBIAN-CVE-2026-0994
PyPIprotobuf6.33.5GHSA-7gcm-g887-7qv7
PyPIprotobuf5.29.6GHSA-7gcm-g887-7qv7
PyPIprotobuf5.29.6, 6.33.5PYSEC-2026-1805
Rocky Linux:10protobuf0:3.19.6-15.el10_1RLSA-2026:3094
Rocky Linux:9protobuf0:3.14.0-17.el9_7RLSA-2026:3095
Ubuntu:22.04:LTSprotobuf3.12.4-1ubuntu7.22.04.6UBUNTU-CVE-2026-0994
Ubuntu:24.04:LTSprotobuf3.21.12-8.2ubuntu0.3UBUNTU-CVE-2026-0994
Ubuntu:25.10protobuf3.21.12-11ubuntu3.1UBUNTU-CVE-2026-0994
Ubuntu:26.04:LTSprotobuf3.21.12-15ubuntu1UBUNTU-CVE-2026-0994
Ubuntu:26.10protobuf3.21.12-15ubuntu1UBUNTU-CVE-2026-0994

Affected products (as reported)

VendorProductVersions
Python Protobuf <=v33.4

Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References