CVE-2026-0994: Protobuf JSON Recursion Depth Bypass Vulnerability
Summary
CVE-2026-0994: protobuf affected by a JSON recursion depth bypass. Affects protobuf versions < 6.33.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Protobuf, or Protocol Buffers, is a language-agnostic binary serialization format developed by Google. It is widely used for efficient data interchange between applications. The library provides support for various programming languages, including Python, and is known for its performance and ease of use. However, it is susceptible to certain vulnerabilities, including the JSON recursion depth bypass issue, which can lead to denial-of-service attacks.
Vulnerability Detail
A denial-of-service (DoS) vulnerability exists in the google.protobuf.json_format.ParseDict() function in Python. The vulnerability arises from a flaw in the internal handling of google.protobuf.Any messages, where the max_recursion_depth limit can be bypassed. This allows an attacker to supply deeply nested Any structures, which can exhaust Python's recursion stack and trigger a RecursionError. The lack of proper recursion depth accounting in the Any-handling logic is the root cause of this issue, making it a significant risk for applications relying on this functionality.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can limit the depth of nested structures when using the ParseDict function. However, this may not be a comprehensive solution and should only be used until the package is updated.
Conclusion
The CVE-2026-0994 vulnerability in the protobuf package poses a significant risk due to its potential for denial-of-service attacks. It is crucial to update to a patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for protobuf →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary consequence of this vulnerability is a denial-of-service attack, which can cause your application to crash or become unresponsive.
Yes, you should upgrade to a version higher than 6.33.4 to ensure that you are not affected by this vulnerability.
Vulert is a monitoring tool that uses Pipfile.lock to track and alert in real-time for open-source vulnerabilities in your software, helping you maintain security.
References
Related vulnerabilities
Recent vulnerabilities recorded for protobuf.
