Critical Security Update for Protobuf Package: Denial of Service Vulnerability
Summary
ALSA-2026:3095: Important: protobuf security update. Affects protobuf versions < 3.14.0-17.el9_7. Fixed in 3.14.0-17.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Protobuf package, part of the AlmaLinux ecosystem, provides Protocol Buffers, a data interchange format developed by Google. It allows for efficient serialization of structured data, making it widely used in various applications for data communication. The package includes components such as protobuf-compiler, protobuf-devel, and python3-protobuf, which are essential for developers working with Protocol Buffers in different programming environments.
Vulnerability Detail
The vulnerability identified as CVE-2026-0994 is a Denial of Service (DoS) issue caused by a recursion depth bypass in the Protobuf package. This flaw allows attackers to exploit the serialization process, potentially leading to excessive resource consumption and application crashes. The vulnerability arises from insufficient checks on recursion depth, enabling crafted input to bypass limits and trigger deep recursion, which can exhaust system resources.
How To Fix
Minimum fixed version
3.14.0-17.el9_7
This is the first release that contains the fix.
sudo dnf update protobufTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the security update as soon as it is available.
Conclusion
The Protobuf package has a critical vulnerability (CVE-2026-0994) that can lead to Denial of Service attacks. Users are strongly advised to update to the patched version 3.14.0-17.el9_7 to ensure the security and stability of their applications. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for protobuf →
FAQ
CVE-2026-0994 is a Denial of Service vulnerability in the Protobuf package that allows attackers to exploit recursion depth limits.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to application crashes and excessive resource consumption, impacting service availability.
Yes, a patch is available in version 3.14.0-17.el9_7 of the Protobuf package and its related components.
While there are no specific workarounds, it is crucial to prioritize updating the package to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for protobuf.
