CVE catalog

CVE-2026-0994

Protocol Buffers vulnerability

Severity: High · CVSS 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Jan 23, 2026, 2:55:16 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.71% · Oct 25, 2026

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	protobuf	sid	`3.21.12-17`	fixed
Debian	protobuf	forky	`3.21.12-17`	fixed
Debian	protobuf	trixie	`3.21.12-11+deb13u1`	fixed
Debian	protobuf	bookworm	`3.21.12-3+deb12u1`	fixed
Ubuntu	protobuf	noble	`3.21.12-3+deb12u1`	fixed
Ubuntu	protobuf	noble	`3.21.12-8.2ubuntu0.3`	fixed
Ubuntu	elpa-protobuf-mode	noble	`3.21.12-8.2ubuntu0.3`	fixed
Ubuntu	libprotobuf-dev	noble	`3.21.12-8.2ubuntu0.3`	fixed
Ubuntu	libprotobuf-java	noble	`3.21.12-8.2ubuntu0.3`	fixed
Ubuntu	libprotobuf-lite32t64	noble	`3.21.12-8.2ubuntu0.3`	fixed
Ubuntu	libprotobuf32t64	noble	`3.21.12-8.2ubuntu0.3`	fixed
Ubuntu	libprotoc-dev	noble	`3.21.12-8.2ubuntu0.3`	fixed
Ubuntu	libprotoc32t64	noble	`3.21.12-8.2ubuntu0.3`	fixed
Ubuntu	php-google-protobuf	noble	`3.21.12-8.2ubuntu0.3`	fixed
Ubuntu	protobuf-compiler	noble	`3.21.12-8.2ubuntu0.3`	fixed
Ubuntu	python3-protobuf	noble	`3.21.12-8.2ubuntu0.3`	fixed
Ubuntu	ruby-google-protobuf	noble	`3.21.12-8.2ubuntu0.3`	fixed
PyPI	protobuf	Not reported	`5.29.6`	fixed
PyPI	protobuf	Not reported	`5.29.6`	fixed
PyPI	protobuf	Not reported	`6.33.5`	fixed
PyPI	protobuf	Not reported	`5.29.6`	fixed
Cpe	protobuf	Not reported	Not reported	unknown
Ubuntu	protobuf	22.04	`3.12.4-1ubuntu3`	vulnerable
Ubuntu	protobuf	22.04	`3.12.4-1ubuntu5`	vulnerable
Ubuntu	protobuf	22.04	`3.12.4-1ubuntu6`	vulnerable
Ubuntu	protobuf	22.04	`3.12.4-1ubuntu7`	vulnerable
Ubuntu	protobuf	22.04	`3.12.4-1ubuntu7.22.04.1`	vulnerable
Ubuntu	protobuf	22.04	`3.12.4-1ubuntu7.22.04.2`	vulnerable
Ubuntu	protobuf	22.04	`3.12.4-1ubuntu7.22.04.4`	vulnerable
Ubuntu	protobuf	22.04	`3.12.4-1ubuntu7.22.04.6`	fixed
Ubuntu	protobuf	24.04	`3.21.12-7ubuntu1`	vulnerable
Ubuntu	protobuf	24.04	`3.21.12-8ubuntu1`	vulnerable
Ubuntu	protobuf	24.04	`3.21.12-8ubuntu5`	vulnerable
Ubuntu	protobuf	24.04	`3.21.12-8.2`	vulnerable
Ubuntu	protobuf	24.04	`3.21.12-8.2build1`	vulnerable
Ubuntu	protobuf	24.04	`3.21.12-8.2ubuntu0.1`	vulnerable
Ubuntu	protobuf	24.04	`3.21.12-8.2ubuntu0.2`	vulnerable
Ubuntu	protobuf	24.04	`3.21.12-8.2ubuntu0.3`	fixed
Ubuntu	protobuf	25.10	`3.21.12-10build2`	vulnerable
Ubuntu	protobuf	25.10	`3.21.12-11`	vulnerable
Ubuntu	protobuf	25.10	`3.21.12-11ubuntu1`	vulnerable
Ubuntu	protobuf	25.10	`3.21.12-11ubuntu3`	vulnerable
Ubuntu	protobuf	25.10	`3.21.12-11ubuntu3.1`	fixed
Opensuse	protobuf	tumbleweed	`34.1-1.1`	fixed
Suse	protobuf	linux micro 6.0	`23.4-11.1`	fixed
Suse	protobuf	linux micro 6.1	`23.4-slfo.1.1_3.1`	fixed
Suse	protobuf	linux enterprise micro 5.5	`25.1-150500.12.14.1`	fixed
Suse	protobuf	linux enterprise module for public cloud 15 sp5	`25.1-150500.12.14.1`	fixed
Suse	protobuf	linux enterprise module for basesystem 15 sp7	`25.1-150600.16.16.1`	fixed
Suse	protobuf	linux enterprise module for development tools 15 sp7	`25.1-150600.16.16.1`	fixed
Suse	protobuf	linux enterprise module for python 3 15 sp7	`25.1-150600.16.16.1`	fixed
Opensuse	protobuf	leap 15.6	`25.1-150600.16.16.1`	fixed
Suse	protobuf	linux enterprise micro 5.3	`3.9.2-150200.4.30.1`	fixed
Suse	protobuf	linux enterprise micro 5.4	`3.9.2-150200.4.30.1`	fixed
Suse	protobuf	linux enterprise micro 5.5	`3.9.2-150200.4.30.1`	fixed
Suse	protobuf	linux enterprise module for basesystem 15 sp7	`3.9.2-150200.4.30.1`	fixed
Suse	protobuf	linux enterprise module for package hub 15 sp7	`3.9.2-150200.4.30.1`	fixed
Suse	protobuf	linux enterprise module for public cloud 15 sp4	`3.9.2-150200.4.30.1`	fixed
Suse	protobuf	linux enterprise module for public cloud 15 sp5	`3.9.2-150200.4.30.1`	fixed
Suse	protobuf	linux enterprise module for public cloud 15 sp6	`3.9.2-150200.4.30.1`	fixed
Suse	protobuf	linux enterprise module for public cloud 15 sp7	`3.9.2-150200.4.30.1`	fixed
Suse	protobuf	linux enterprise micro 5.2	`3.9.2-150200.4.30.1`	fixed
Suse	protobuf	linux enterprise micro 5.3	`25.1-150400.9.19.1`	fixed
Suse	protobuf	linux enterprise micro 5.4	`25.1-150400.9.19.1`	fixed
Suse	protobuf	linux enterprise module for public cloud 15 sp4	`25.1-150400.9.19.1`	fixed
Opensuse	onnxruntime	tumbleweed	`1.31.0-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	protobuf	source	sid	`3.21.12-16`	not yet assigned	Not reported	[1126302]
Debian	protobuf	source	forky	`3.21.12-16`	not yet assigned	Not reported	[1126302]
Debian	protobuf	source	trixie	`3.21.12-11+deb13u1`	not yet assigned	Not reported	[1126302]
Debian	protobuf	source	bookworm	`3.21.12-3+deb12u1`	not yet assigned	Not reported	[1126302]
Ubuntu	protobuf	deb	noble	`3.21.12-3+deb12u1`	Not reported	Not reported	Not reported
Ubuntu	protobuf	deb	noble	`3.21.12-8.2ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	elpa-protobuf-mode	deb	noble	`3.21.12-8.2ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	libprotobuf-dev	deb	noble	`3.21.12-8.2ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	libprotobuf-java	deb	noble	`3.21.12-8.2ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	libprotobuf-lite32t64	deb	noble	`3.21.12-8.2ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	libprotobuf32t64	deb	noble	`3.21.12-8.2ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	libprotoc-dev	deb	noble	`3.21.12-8.2ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	libprotoc32t64	deb	noble	`3.21.12-8.2ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	php-google-protobuf	deb	noble	`3.21.12-8.2ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	protobuf-compiler	deb	noble	`3.21.12-8.2ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	python3-protobuf	deb	noble	`3.21.12-8.2ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	ruby-google-protobuf	deb	noble	`3.21.12-8.2ubuntu0.3`	Not reported	Not reported	Not reported
PyPI	protobuf	PyPI	Not reported	`5.29.6`	Not reported	GHSA-7GCM-G887-7QV7	Not reported
PyPI	protobuf	PyPI	Not reported	`5.29.6`	Not reported	Not reported	Not reported
PyPI	protobuf	PyPI	Not reported	`6.33.5`	Not reported	Not reported	Not reported
PyPI	protobuf	PyPI	Not reported	`5.29.6`	Not reported	Not reported	Not reported
Ubuntu	protobuf	deb	22.04	`3.12.4-1ubuntu7.22.04.6`	Not reported	USN-8063-1	Not reported
Ubuntu	protobuf	deb	24.04	`3.21.12-8.2ubuntu0.3`	Not reported	USN-8063-1	Not reported
Ubuntu	protobuf	deb	25.10	`3.21.12-11ubuntu3.1`	Not reported	USN-8063-1	Not reported
Opensuse	protobuf	rpm	tumbleweed	`34.1-1.1`	Not reported	OPENSUSE-SU-2026:10515-1	Not reported
Suse	protobuf	rpm	linux micro 6.0	`23.4-11.1`	Not reported	SUSE-SU-2026:20352-1	Not reported
Suse	protobuf	rpm	linux micro 6.1	`23.4-slfo.1.1_3.1`	Not reported	SUSE-SU-2026:20490-1	Not reported
Suse	protobuf	rpm	linux enterprise micro 5.5	`25.1-150500.12.14.1`	Not reported	SUSE-SU-2026:0517-1	Not reported
Suse	protobuf	rpm	linux enterprise module for public cloud 15 sp5	`25.1-150500.12.14.1`	Not reported	SUSE-SU-2026:0517-1	Not reported
Suse	protobuf	rpm	linux enterprise module for basesystem 15 sp7	`25.1-150600.16.16.1`	Not reported	SUSE-SU-2026:0374-1	Not reported
Suse	protobuf	rpm	linux enterprise module for development tools 15 sp7	`25.1-150600.16.16.1`	Not reported	SUSE-SU-2026:0374-1	Not reported
Suse	protobuf	rpm	linux enterprise module for python 3 15 sp7	`25.1-150600.16.16.1`	Not reported	SUSE-SU-2026:0374-1	Not reported
Opensuse	protobuf	rpm	leap 15.6	`25.1-150600.16.16.1`	Not reported	SUSE-SU-2026:0374-1	Not reported
Suse	protobuf	rpm	linux enterprise micro 5.3	`3.9.2-150200.4.30.1`	Not reported	SUSE-SU-2026:0618-1	Not reported
Suse	protobuf	rpm	linux enterprise micro 5.4	`3.9.2-150200.4.30.1`	Not reported	SUSE-SU-2026:0618-1	Not reported
Suse	protobuf	rpm	linux enterprise micro 5.5	`3.9.2-150200.4.30.1`	Not reported	SUSE-SU-2026:0618-1	Not reported
Suse	protobuf	rpm	linux enterprise module for basesystem 15 sp7	`3.9.2-150200.4.30.1`	Not reported	SUSE-SU-2026:0618-1	Not reported
Suse	protobuf	rpm	linux enterprise module for package hub 15 sp7	`3.9.2-150200.4.30.1`	Not reported	SUSE-SU-2026:0618-1	Not reported
Suse	protobuf	rpm	linux enterprise module for public cloud 15 sp4	`3.9.2-150200.4.30.1`	Not reported	SUSE-SU-2026:0618-1	Not reported
Suse	protobuf	rpm	linux enterprise module for public cloud 15 sp5	`3.9.2-150200.4.30.1`	Not reported	SUSE-SU-2026:0618-1	Not reported
Suse	protobuf	rpm	linux enterprise module for public cloud 15 sp6	`3.9.2-150200.4.30.1`	Not reported	SUSE-SU-2026:0618-1	Not reported
Suse	protobuf	rpm	linux enterprise module for public cloud 15 sp7	`3.9.2-150200.4.30.1`	Not reported	SUSE-SU-2026:0618-1	Not reported
Suse	protobuf	rpm	linux enterprise micro 5.2	`3.9.2-150200.4.30.1`	Not reported	SUSE-SU-2026:0618-1	Not reported
Suse	protobuf	rpm	linux enterprise micro 5.3	`25.1-150400.9.19.1`	Not reported	SUSE-SU-2026:0563-1	Not reported
Suse	protobuf	rpm	linux enterprise micro 5.4	`25.1-150400.9.19.1`	Not reported	SUSE-SU-2026:0563-1	Not reported
Suse	protobuf	rpm	linux enterprise module for public cloud 15 sp4	`25.1-150400.9.19.1`	Not reported	SUSE-SU-2026:0563-1	Not reported
Opensuse	onnxruntime	rpm	tumbleweed	`1.31.0-1.1`	Not reported	OPENSUSE-SU-2026:12274-1	Not reported

[Debian bug #1126302]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[libonnxruntime1]Unknown
Source package: [onnxruntime]
Details (1)
- 1.27.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.31.0-1.1
  Version impact unknown
  usn · onnxruntime · opensuse · tumbleweed
[libprotobuf34_2_0]Unknown
Source package: [protobuf]
Details (1)
- 34.2-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 34.1-1.1
  Version impact unknown
  usn · protobuf · opensuse · tumbleweed
[libprotobuf34_2_0-32bit]Unknown
Source package: [protobuf]
Details (1)
- 34.2-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 34.1-1.1
  Version impact unknown
  usn · protobuf · opensuse · tumbleweed
[libprotobuf-lite34_2_0]Unknown
Source package: [protobuf]
Details (1)
- 34.2-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 34.1-1.1
  Version impact unknown
  usn · protobuf · opensuse · tumbleweed
[libprotobuf-lite34_2_0-32bit]Unknown
Source package: [protobuf]
Details (1)
- 34.2-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 34.1-1.1
  Version impact unknown
  usn · protobuf · opensuse · tumbleweed
[libprotoc34_2_0]Unknown
Source package: [protobuf]
Details (1)
- 34.2-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 34.1-1.1
  Version impact unknown
  usn · protobuf · opensuse · tumbleweed
[libprotoc34_2_0-32bit]Unknown
Source package: [protobuf]
Details (1)
- 34.2-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 34.1-1.1
  Version impact unknown
  usn · protobuf · opensuse · tumbleweed
[libutf8_range-34_2_0]Unknown
Source package: [protobuf]
Details (1)
- 34.2-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 34.1-1.1
  Version impact unknown
  usn · protobuf · opensuse · tumbleweed
[libutf8_range-34_2_0-32bit]Unknown
Source package: [protobuf]
Details (1)
- 34.2-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 34.1-1.1
  Version impact unknown
  usn · protobuf · opensuse · tumbleweed
[onnxruntime-devel]Unknown
Source package: [onnxruntime]
Details (1)
- 1.27.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.31.0-1.1
  Version impact unknown
  usn · onnxruntime · opensuse · tumbleweed
[protobuf-devel]Unknown
Source package: [protobuf]
Details (1)
- 34.2-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 34.1-1.1
  Version impact unknown
  usn · protobuf · opensuse · tumbleweed
[python313-onnxruntime]Unknown
Source package: [onnxruntime]
Details (1)
- 1.27.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.31.0-1.1
  Version impact unknown
  usn · onnxruntime · opensuse · tumbleweed
[python314-onnxruntime]Unknown
Source package: [onnxruntime]
Details (1)
- 1.27.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.31.0-1.1
  Version impact unknown
  usn · onnxruntime · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[elpa-protobuf-mode]Fixed
Source package: [protobuf]
Details (2)
- 3.21.12-3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.21.12-3+deb12u1
  usn · protobuf · debian · bookworm; usn · protobuf · debian · 12
- 3.21.12-3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.21.12-3+deb12u1
  usn · protobuf · debian · bookworm; usn · protobuf · debian · 12
[libprotobuf32]Fixed
Source package: [protobuf]
Details (2)
- 3.21.12-3+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 3.21.12-3+deb12u1
  usn · protobuf · debian · bookworm; usn · protobuf · debian · 12
- 3.21.12-3+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 3.21.12-3+deb12u1
  usn · protobuf · debian · bookworm; usn · protobuf · debian · 12
[libprotobuf-dev]Fixed
Source package: [protobuf]
Details (2)
- 3.21.12-3+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 3.21.12-3+deb12u1
  usn · protobuf · debian · bookworm; usn · protobuf · debian · 12
- 3.21.12-3+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 3.21.12-3+deb12u1
  usn · protobuf · debian · bookworm; usn · protobuf · debian · 12
[libprotobuf-java]Fixed
Source package: [protobuf]
Details (2)
- 3.21.12-3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.21.12-3+deb12u1
  usn · protobuf · debian · bookworm; usn · protobuf · debian · 12
- 3.21.12-3+deb12u1 · all · bookworm
  Fixed · Fixed: 3.21.12-3+deb12u1
  usn · protobuf · debian · bookworm; usn · protobuf · debian · 12
[libprotobuf-lite32]Fixed
Source package: [protobuf]
Details (2)
- 3.21.12-3+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 3.21.12-3+deb12u1
  usn · protobuf · debian · bookworm; usn · protobuf · debian · 12
- 3.21.12-3+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 3.21.12-3+deb12u1
  usn · protobuf · debian · bookworm; usn · protobuf · debian · 12
[libprotoc32]Fixed
Source package: [protobuf]
Details (2)
- 3.21.12-3+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 3.21.12-3+deb12u1
  usn · protobuf · debian · bookworm; usn · protobuf · debian · 12
- 3.21.12-3+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 3.21.12-3+deb12u1
  usn · protobuf · debian · bookworm; usn · protobuf · debian · 12
[libprotoc-dev]Fixed
Source package: [protobuf]
Details (2)
- 3.21.12-3+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 3.21.12-3+deb12u1
  usn · protobuf · debian · bookworm; usn · protobuf · debian · 12
- 3.21.12-3+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 3.21.12-3+deb12u1
  usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

Next results

Observed: Oct 27, 2026, 6:02:01 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]