Critical Security Update for Protobuf Package: Denial of Service Vulnerability
Summary
ALSA-2026:3094: Important: protobuf security update. Affects protobuf versions < 3.19.6-15.el10_1. Fixed in 3.19.6-15.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The protobuf package provides Protocol Buffers, a data interchange format developed by Google. It allows for efficient encoding of structured data, making it extensible and flexible for various applications. The package is widely used for serializing structured data in a compact format, which is essential for data transmission and storage. However, it has recently been identified as vulnerable to a Denial of Service (DoS) attack due to a recursion depth bypass, which can be exploited to disrupt services.
Vulnerability Detail
The vulnerability, identified as CVE-2026-0994, stems from a flaw in the protobuf implementation that allows attackers to bypass recursion depth limits. This can lead to excessive resource consumption, causing the application to crash or become unresponsive. The potential ramifications include service outages and degraded performance, which can significantly impact applications relying on protobuf for data serialization.
How To Fix
Minimum fixed version
3.19.6-15.el10_1
This is the first release that contains the fix.
sudo dnf update protobufTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the input size or implement additional validation checks to prevent excessive recursion. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
In summary, the protobuf package has a critical vulnerability that can lead to Denial of Service attacks. It is crucial to update to the patched version 3.19.6-15.el10_1 to ensure the security and stability of applications using this package. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for protobuf →
FAQ
The vulnerability allows for a Denial of Service attack due to a recursion depth bypass, which can lead to application crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Failure to address this vulnerability can result in service outages, degraded performance, and potential exploitation by malicious actors.
Yes, you can implement input size limitations and validation checks as a temporary measure until the package is updated.
More details can be found on the CVE page for CVE-2026-0994, which includes technical specifics and acknowledgments.
Related vulnerabilities
Recent vulnerabilities recorded for protobuf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
