CVE-2026-45740

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

May 13, 2026, 2:46:02 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.26% · Oct 25, 2026

A flaw was found in protobufjs. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a crafted JSON descriptor with deeply nested namespace definitions. This can lead to the exhaustion of the JavaScript call stack during descriptor loading, making the application unresponsive. protobufjs: protobufjs: Denial of Service via crafted JSON descriptors This is an Important denial of service flaw in protobufjs, which could allow a remote attacker to exhaust the JavaScript call stack by providing a specially crafted JSON descriptor with deeply nested namespace definitions. This vulnerability impacts Red Hat products that utilize protobufjs for processing protobuf definitions potentially leading to application unresponsiveness. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.