CVE-2026-0994: Protobuf JSON Recursion Depth Bypass Vulnerability
Summary
CVE-2026-0994: protobuf affected by a JSON recursion depth bypass. Affects protobuf across 2 version ranges.
< 5.29.6
>= 6.30.0rc1, < 6.33.5
Fixed in 5.29.6 or 6.33.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Protobuf, short for Protocol Buffers, is a language-agnostic binary serialization format developed by Google. It is widely used for data interchange in various applications due to its efficiency and ease of use. The library allows developers to define data structures and services in a .proto file, which can then be compiled into code for multiple programming languages. However, the library has a vulnerability that affects its JSON parsing functionality, specifically in the handling of nested google.protobuf.Any messages.
Vulnerability Detail
A denial-of-service (DoS) vulnerability exists in the google.protobuf.json_format.ParseDict() function in Python. The vulnerability arises from a flaw in the recursion depth accounting when parsing nested google.protobuf.Any messages. An attacker can exploit this flaw by supplying deeply nested Any structures that bypass the intended recursion limit. This can lead to exhaustion of Python's recursion stack, resulting in a RecursionError and potentially crashing the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.29.65.29.6pip install --upgrade "protobuf==5.29.6" -
>= 6.30.0rc1, < 6.33.56.33.5pip install --upgrade "protobuf==6.33.5"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the depth of nested structures that your application accepts. This can be done by implementing custom validation logic before passing data to the ParseDict function. For example, you can check the depth of the input structure and reject any that exceed a certain threshold.
Conclusion
The CVE-2026-0994 vulnerability in the protobuf package poses a significant risk due to its potential for denial-of-service attacks through JSON recursion depth bypass. It is crucial for developers to update to the patched versions of the library and implement necessary validation checks to mitigate risks.
See every vulnerability recorded for protobuf →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to denial-of-service attacks, causing applications to crash due to stack overflow errors.
Yes, versions 5.29.6 and 6.33.5 have been patched to address this vulnerability.
If an immediate update is not possible, implement input validation to limit the depth of nested structures as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for protobuf.
