Vulnerability-Lookup

SUSE-SU-2026:20753-1

Vulnerability from csaf_suse - Published: 2026-03-18 18:11 - Updated: 2026-10-15 17:05

Summary

Security update for protobuf

Severity

Moderate

Notes

Title of the patch: Security update for protobuf

Description of the patch: This update for protobuf fixes the following issues: Security fixes: - CVE-2025-4565: Fixed parsing of untrusted Protocol Buffers data containing an arbitrary number of recursive groups or messages that could lead to crash due to RecursionError (bsc#1244663). - CVE-2026-0994: Fixed google.protobuf.Any recursion depth bypass in Python json_format.ParseDict (bsc#1257173). Other fixes: - Fixed import issues of reverse-dependency packages within the google namespace (bsc#1244918).

Patchnames: SUSE-SL-Micro-6.2-408

CVE-2025-4565

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-0994

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2025-4565

Threats

Impact moderate

References

13 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1244663	self
https://bugzilla.suse.com/1244918	self
https://bugzilla.suse.com/1257173	self
https://www.suse.com/security/cve/CVE-2025-4565/	self
https://www.suse.com/security/cve/CVE-2026-0994/	self
https://www.suse.com/security/cve/CVE-2025-4565	external
https://bugzilla.suse.com/1244663	external
https://www.suse.com/security/cve/CVE-2026-0994	external
https://bugzilla.suse.com/1257173	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for protobuf",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for protobuf fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2025-4565: Fixed parsing of untrusted Protocol Buffers data containing an arbitrary number of recursive\n  groups or messages that could lead to crash due to RecursionError (bsc#1244663).\n- CVE-2026-0994: Fixed google.protobuf.Any recursion depth bypass in Python json_format.ParseDict (bsc#1257173).\n\nOther fixes:\n\n- Fixed import issues of reverse-dependency packages within the google namespace (bsc#1244918).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SL-Micro-6.2-408",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20753-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:20753-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620753-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:20753-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024831.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1244663",
        "url": "https://bugzilla.suse.com/1244663"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1244918",
        "url": "https://bugzilla.suse.com/1244918"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257173",
        "url": "https://bugzilla.suse.com/1257173"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-4565 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-4565/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0994 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0994/"
      }
    ],
    "title": "Security update for protobuf",
    "tracking": {
      "current_release_date": "2026-10-15T17:05:14Z",
      "generator": {
        "date": "2026-03-18T18:11:52Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:20753-1",
      "initial_release_date": "2026-03-18T18:11:52Z",
      "revision_history": [
        {
          "date": "2026-03-18T18:11:52Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T18:44:35Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T19:35:13Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T15:31:44Z",
          "number": "4",
          "summary": "unknown changes"
        },
        {
          "date": "2026-10-12T17:22:57Z",
          "number": "5",
          "summary": "unknown changes"
        },
        {
          "date": "2026-10-15T17:05:14Z",
          "number": "6",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "6"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libprotobuf28_3_0-0:28.3-160000.3.1.aarch64",
                "product": {
                  "name": "libprotobuf28_3_0-0:28.3-160000.3.1.aarch64",
                  "product_id": "libprotobuf28_3_0-0:28.3-160000.3.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:google:protobuf:28.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libprotobuf28_3_0@28.3-160000.3.1?arch=aarch64\u0026upstream=protobuf-0:28.3-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libutf8_range-28_3_0-0:28.3-160000.3.1.aarch64",
                "product": {
                  "name": "libutf8_range-28_3_0-0:28.3-160000.3.1.aarch64",
                  "product_id": "libutf8_range-28_3_0-0:28.3-160000.3.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:google:protobuf:28.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libutf8_range-28_3_0@28.3-160000.3.1?arch=aarch64\u0026upstream=protobuf-0:28.3-160000.3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libprotobuf28_3_0-0:28.3-160000.3.1.ppc64le",
                "product": {
                  "name": "libprotobuf28_3_0-0:28.3-160000.3.1.ppc64le",
                  "product_id": "libprotobuf28_3_0-0:28.3-160000.3.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:google:protobuf:28.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libprotobuf28_3_0@28.3-160000.3.1?arch=ppc64le\u0026upstream=protobuf-0:28.3-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libutf8_range-28_3_0-0:28.3-160000.3.1.ppc64le",
                "product": {
                  "name": "libutf8_range-28_3_0-0:28.3-160000.3.1.ppc64le",
                  "product_id": "libutf8_range-28_3_0-0:28.3-160000.3.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:google:protobuf:28.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libutf8_range-28_3_0@28.3-160000.3.1?arch=ppc64le\u0026upstream=protobuf-0:28.3-160000.3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libprotobuf28_3_0-0:28.3-160000.3.1.s390x",
                "product": {
                  "name": "libprotobuf28_3_0-0:28.3-160000.3.1.s390x",
                  "product_id": "libprotobuf28_3_0-0:28.3-160000.3.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:google:protobuf:28.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libprotobuf28_3_0@28.3-160000.3.1?arch=s390x\u0026upstream=protobuf-0:28.3-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libutf8_range-28_3_0-0:28.3-160000.3.1.s390x",
                "product": {
                  "name": "libutf8_range-28_3_0-0:28.3-160000.3.1.s390x",
                  "product_id": "libutf8_range-28_3_0-0:28.3-160000.3.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:google:protobuf:28.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libutf8_range-28_3_0@28.3-160000.3.1?arch=s390x\u0026upstream=protobuf-0:28.3-160000.3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libprotobuf28_3_0-0:28.3-160000.3.1.x86_64",
                "product": {
                  "name": "libprotobuf28_3_0-0:28.3-160000.3.1.x86_64",
                  "product_id": "libprotobuf28_3_0-0:28.3-160000.3.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:google:protobuf:28.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libprotobuf28_3_0@28.3-160000.3.1?arch=x86_64\u0026upstream=protobuf-0:28.3-160000.3.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libutf8_range-28_3_0-0:28.3-160000.3.1.x86_64",
                "product": {
                  "name": "libutf8_range-28_3_0-0:28.3-160000.3.1.x86_64",
                  "product_id": "libutf8_range-28_3_0-0:28.3-160000.3.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:google:protobuf:28.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libutf8_range-28_3_0@28.3-160000.3.1?arch=x86_64\u0026upstream=protobuf-0:28.3-160000.3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.2",
                "product": {
                  "name": "SUSE Linux Micro 6.2",
                  "product_id": "SUSE Linux Micro 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libprotobuf28_3_0-0:28.3-160000.3.1.aarch64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.aarch64"
        },
        "product_reference": "libprotobuf28_3_0-0:28.3-160000.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libprotobuf28_3_0-0:28.3-160000.3.1.ppc64le as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.ppc64le"
        },
        "product_reference": "libprotobuf28_3_0-0:28.3-160000.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libprotobuf28_3_0-0:28.3-160000.3.1.s390x as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.s390x"
        },
        "product_reference": "libprotobuf28_3_0-0:28.3-160000.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libprotobuf28_3_0-0:28.3-160000.3.1.x86_64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.x86_64"
        },
        "product_reference": "libprotobuf28_3_0-0:28.3-160000.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libutf8_range-28_3_0-0:28.3-160000.3.1.aarch64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.aarch64"
        },
        "product_reference": "libutf8_range-28_3_0-0:28.3-160000.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libutf8_range-28_3_0-0:28.3-160000.3.1.ppc64le as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.ppc64le"
        },
        "product_reference": "libutf8_range-28_3_0-0:28.3-160000.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libutf8_range-28_3_0-0:28.3-160000.3.1.s390x as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.s390x"
        },
        "product_reference": "libutf8_range-28_3_0-0:28.3-160000.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libutf8_range-28_3_0-0:28.3-160000.3.1.x86_64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.x86_64"
        },
        "product_reference": "libutf8_range-28_3_0-0:28.3-160000.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-4565",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-4565"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Any project that uses Protobuf Pure-Python backend  to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP  tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u003e6.31.1 or beyond commit  17838beda2943d08b8a9d4df5b68f5f04f26d901",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.aarch64",
          "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.ppc64le",
          "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.s390x",
          "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.x86_64",
          "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.aarch64",
          "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.ppc64le",
          "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.s390x",
          "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-4565",
          "url": "https://www.suse.com/security/cve/CVE-2025-4565"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1244663 for CVE-2025-4565",
          "url": "https://bugzilla.suse.com/1244663"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.aarch64",
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.ppc64le",
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.s390x",
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.x86_64",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.aarch64",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.ppc64le",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.s390x",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.aarch64",
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.ppc64le",
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.s390x",
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.x86_64",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.aarch64",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.ppc64le",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.s390x",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-18T18:11:52Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-4565"
    },
    {
      "cve": "CVE-2026-0994",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0994"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.\n\nDue to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python\u0027s recursion stack and causing a RecursionError.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.aarch64",
          "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.ppc64le",
          "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.s390x",
          "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.x86_64",
          "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.aarch64",
          "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.ppc64le",
          "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.s390x",
          "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0994",
          "url": "https://www.suse.com/security/cve/CVE-2026-0994"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257173 for CVE-2026-0994",
          "url": "https://bugzilla.suse.com/1257173"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.aarch64",
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.ppc64le",
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.s390x",
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.x86_64",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.aarch64",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.ppc64le",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.s390x",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.aarch64",
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.ppc64le",
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.s390x",
            "SUSE Linux Micro 6.2:libprotobuf28_3_0-0:28.3-160000.3.1.x86_64",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.aarch64",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.ppc64le",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.s390x",
            "SUSE Linux Micro 6.2:libutf8_range-28_3_0-0:28.3-160000.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-18T18:11:52Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-0994"
    }
  ]
}

CVE-2025-4565 (GCVE-0-2025-4565)

Vulnerability from cvelistv5 – Published: 2025-06-16 14:50 – Updated: 2025-06-16 15:39

Title

Unbounded recursion in Python Protobuf

Summary

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-16 15:38 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

Google CNA under the Google root

CNA scorecard B 77/100 over 40 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/protocolbuffers/protobuf/commi…

Impacted products

1 product

Vendor	Product	Version
protocolbuffers	Python-Protobuf	Affected: 0 , < 4.25.8 (semver) Affected: 0 , < 5.29.5 (semver) Affected: 0 , < 6.31.1 (semver)

Date Public

2025-05-12 22:00

Credits

Alexis Challande - Trail of Bits Ecosystem Security Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-4565",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-16T15:38:57.654894Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-16T15:39:18.263Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/protocolbuffers/protobuf/",
          "defaultStatus": "unaffected",
          "packageName": "protobuf",
          "product": "Python-Protobuf",
          "programFiles": [
            "python/google/protobuf/internal/decoder.py"
          ],
          "repo": "https://github.com/protocolbuffers/protobuf/",
          "vendor": "protocolbuffers",
          "versions": [
            {
              "lessThan": "4.25.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.29.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.31.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pypi.org/project/protobuf/",
          "defaultStatus": "unaffected",
          "product": "Python-Protobuf",
          "repo": "https://pypi.org/project/protobuf/",
          "vendor": "protocolbuffers",
          "versions": [
            {
              "lessThan": "4.25.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.29.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.31.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexis Challande - Trail of Bits Ecosystem Security Team"
        }
      ],
      "datePublic": "2025-05-12T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAny project that uses \u003c/span\u003e\u003cstrong\u003eProtobuf Pure-Python backend\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;to parse untrusted Protocol Buffers data containing an arbitrary number of recursive \u003c/span\u003e\u003ccode\u003egroup\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003es, recursive \u003c/span\u003e\u003ccode\u003emessage\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003es or a series of \u003c/span\u003e\u003ccode\u003eSGROUP\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u0026gt;6.31.1 or beyond commit\u0026nbsp;17838beda2943d08b8a9d4df5b68f5f04f26d901\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Any project that uses Protobuf Pure-Python backend\u00a0to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP\u00a0tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u003e6.31.1 or beyond commit\u00a017838beda2943d08b8a9d4df5b68f5f04f26d901"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-16T14:50:40.906Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unbounded recursion in Python Protobuf",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2025-4565",
    "datePublished": "2025-06-16T14:50:40.906Z",
    "dateReserved": "2025-05-12T05:48:12.941Z",
    "dateUpdated": "2025-06-16T15:39:18.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-0994 (GCVE-0-2026-0994)

Vulnerability from cvelistv5 – Published: 2026-01-23 14:55 – Updated: 2026-09-01 12:04

Title

Denial of Service in Python Protobuf

Summary

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-23 15:33 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

Google CNA under the Google root

CNA scorecard B 77/100 over 40 records in the last 180 days details

References

21 references

URL	Tags
https://github.com/protocolbuffers/protobuf/pull/25239
https://access.redhat.com/security/cve/CVE-2026-0994	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2432398	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:3959	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3958	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3218	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3094	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3097	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3220	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3059	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3219	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3095	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61627	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3461	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3462	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61629	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8748	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8746	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8747	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16174	vendor-advisoryx_refsource_REDHAT

Impacted products

21 products

Vendor	Product	Version
Python	Protobuf	Affected: <=v33.4 (custom)
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	Unaffected: 0:5.29.6-1.el8ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.5::el8
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9	Unaffected: 0:5.29.6-1.el9ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.5::el9
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	Unaffected: 0:5.29.6-1.el9ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.6::el9
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.19.6-15.el10_1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:3.19.6-11.el10_0.1 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.14.0-17.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:3.14.0-9.el9_0.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:3.14.0-13.el9_2.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:3.14.0-13.el9_4.1 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:3.14.0-16.el9_6.1 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1772160593 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.2	Unaffected: 1772160625 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.2::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1778244546 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1775680192 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1775680262 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AI Inference Server 3.3	Unaffected: 1775749857 , < * (rpm) cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat AMQ Clients	cpe:/a:redhat:amq_clients:2023
Red Hat	Red Hat Ansible Automation Platform 2	cpe:/a:redhat:ansible_automation_platform:2
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat OpenStack Platform 16.2	cpe:/a:redhat:openstack:16.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0994",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-23T15:33:48.514298Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-23T15:34:38.915Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.5::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12-protobuf",
            "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.29.6-1.el8ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12-protobuf",
            "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.29.6-1.el9ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "python3.12-protobuf",
            "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.29.6-1.el9ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1"
            ],
            "defaultStatus": "affected",
            "packageName": "protobuf",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.19.6-15.el10_1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "protobuf",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.19.6-11.el10_0.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "protobuf",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.14.0-17.el9_7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.0"
            ],
            "defaultStatus": "affected",
            "packageName": "protobuf",
            "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.14.0-9.el9_0.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "protobuf",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.14.0-13.el9_2.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "protobuf",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.14.0-13.el9_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "protobuf",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.14.0-16.el9_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1772160593",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-rocm-rhel9",
            "product": "Red Hat AI Inference Server 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1772160625",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-spyre-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1778244546",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1775680192",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/vllm-rocm-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1775680262",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhaiis/model-opt-cuda-rhel9",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1775749857",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_clients:2023"
            ],
            "defaultStatus": "unaffected",
            "packageName": "protobuf",
            "product": "Red Hat AMQ Clients",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python3x-protobuf",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "python-protobuf",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "protobuf-c",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "protobuf",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-01-23T14:55:16.876Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in protobuf. A remote attacker can exploit this denial-of-service (DoS) vulnerability by supplying deeply nested `google.protobuf.Any` messages to the `google.protobuf.json_format.ParseDict()` function. This bypasses the intended recursion depth limit, leading to the exhaustion of Python\u2019s recursion stack and causing a `RecursionError`, which results in a denial of service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-674",
                "description": "Uncontrolled Recursion",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T12:04:47.897Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-0994"
          },
          {
            "name": "RHBZ#2432398",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432398"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0994.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3959"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3958"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3218"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3094"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3097"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3220"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3059"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3219"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3095"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61627"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3461"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3462"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61629"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8748"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8746"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:8747"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:16174"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:3959: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3958: Red Hat Ansible Automation Platform 2.6 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3218: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3094: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3097: Red Hat Enterprise Linux AppStream E4S (v.9.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3220: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3059: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3219: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3095: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:61627: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3461: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3462: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:61629: Red Hat AI Inference Server 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8748: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8746: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:8747: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:16174: Red Hat AI Inference Server 3.3"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-01-23T16:02:59.235Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-01-23T14:55:16.876Z",
            "value": "Made public."
          }
        ],
        "title": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Protobuf",
          "vendor": "Python",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=v33.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDue to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python\u2019s recursion stack and causing a RecursionError.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.\n\nDue to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python\u2019s recursion stack and causing a RecursionError."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-147",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-147: XML Nested Entity Expansion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-30T14:28:11.435Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://github.com/protocolbuffers/protobuf/pull/25239"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Denial of Service in Python Protobuf",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2026-0994",
    "datePublished": "2026-01-23T14:55:16.876Z",
    "dateReserved": "2026-01-15T15:16:22.904Z",
    "dateUpdated": "2026-09-01T12:04:47.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2026:20753-1

CVE-2025-4565 (GCVE-0-2025-4565)

CVE-2026-0994 (GCVE-0-2026-0994)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour