8.2

CVE-2026-0994: google protobuf Uncontrolled Recursion

CVSS: 8.2v4.0HighModified
AliasesSUSE-SU-2026:0374-1SUSE-SU-2026:0517-1SUSE-SU-2026:0563-1
Published 23-01-2026Last modified 01-09-2026
Open JSON

Vulnerability summary

CVE-2026-0994 is a high (CVSS 8.2) Uncontrolled Recursion vulnerability in google protobuf. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.2/10
010
High · v4.0 (CVE.org)
EPSS score
0.72%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 6
OPENSUSE-SU-2026:20390-1RHSA-2026:3958RHSA-2026:3959SUSE-SU-2026:20753-1SUSE-SU-2026:20907-1CGA-JGJC-R94M-FGP2

Timeline

  1. 23-01-2026
    PublishedVulnerability first disclosed.
  2. 01-09-2026
    Last modifiedVulnerability information updated.

Description

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

CVSS metrics

11 scores · 8 sources · 2 versions

EPSS trend

Probability

0.72%

Chance of exploitation in the next 30 days

Percentile

53%

Versus all other CVEs

30-day change

+0.03 pp

From 0.69% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.72%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard66 products
  • airflow-2< 2.11.1-r0
  • airflow-3< 3.2.0-r0
  • airflow-core-2< 2.11.1-r0
  • airflow-core-3< 3.2.0-r2
  • apache-beam-python-3.11-sdk< 2.71.0-r2
Wolfi26 products
  • airflow-3< 3.2.0-r0
  • datadog-agent-7.72-core-integrationsAll versions (No fix recorded)
  • datadog-agent-7.73-core-integrations< 7.73.3-r23
  • datadog-agent-7.74-core-integrations< 7.74.1-r24
  • datadog-agent-7.75-core-integrations< 7.75.4-r2
Suse14 products
  • protobuf&distro=SUSE Linux Enterprise Micro 5.2< 3.9.2-150200.4.30.1
  • protobuf&distro=SUSE Linux Enterprise Micro 5.3< 25.1-150400.9.19.1 | < 3.9.2-150200.4.30.1
  • protobuf&distro=SUSE Linux Enterprise Micro 5.4< 25.1-150400.9.19.1 | < 3.9.2-150200.4.30.1
  • protobuf&distro=SUSE Linux Enterprise Micro 5.5< 25.1-150500.12.14.1 | < 3.9.2-150200.4.30.1
  • protobuf&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 3.9.2-150200.4.30.1 | < 25.1-150600.16.16.1
Redhat11 products
  • protobuf< 0:3.19.6-11.el10_0.1 | < 0:3.14.0-16.el9_6.1 | < 0:3.14.0-13.el9_2.1 | < 0:3.14.0-13.el9_4.1 | < 0:3.19.6-15.el10_1 | < 0:3.14.0-17.el9_7 | < 0:3.14.0-9.el9_0.1
  • protobuf-compiler< 0:3.19.6-11.el10_0.1 | < 0:3.14.0-16.el9_6.1 | < 0:3.14.0-13.el9_4.1 | < 0:3.19.6-15.el10_1 | < 0:3.14.0-17.el9_7
  • protobuf-compiler-debuginfo< 0:3.19.6-11.el10_0.1 | < 0:3.14.0-16.el9_6.1 | < 0:3.14.0-13.el9_2.1 | < 0:3.14.0-13.el9_4.1 | < 0:3.19.6-15.el10_1 | < 0:3.14.0-17.el9_7 | < 0:3.14.0-9.el9_0.1
  • protobuf-debuginfo< 0:3.19.6-11.el10_0.1 | < 0:3.14.0-16.el9_6.1 | < 0:3.14.0-13.el9_2.1 | < 0:3.14.0-13.el9_4.1 | < 0:3.19.6-15.el10_1 | < 0:3.14.0-17.el9_7 | < 0:3.14.0-9.el9_0.1
  • protobuf-debugsource< 0:3.19.6-11.el10_0.1 | < 0:3.14.0-16.el9_6.1 | < 0:3.14.0-13.el9_2.1 | < 0:3.14.0-13.el9_4.1 | < 0:3.19.6-15.el10_1 | < 0:3.14.0-17.el9_7 | < 0:3.14.0-9.el9_0.1
Opensuse2 products
  • protobuf&distro=openSUSE Leap 15.6< 25.1-150600.16.16.1
  • protobuf&distro=openSUSE Tumbleweed< 34.1-1.1
Debian1 product
  • protobuf< 3.21.12-3+deb12u1 | < 3.21.12-11+deb13u1 | < 3.21.12-16
Google1 product
PyPI1 product
  • protobuf< 5.29.6 | ≥ 6.30.0rc1, < 6.33.5
Python1 product
Ubuntu1 product
  • protobuf< 3.0.0-9.1ubuntu1.1+esm4 | < 3.6.1.3-2ubuntu5.2+esm3 | < 3.12.4-1ubuntu7.22.04.6 | < 3.21.12-8.2ubuntu0.3 | < 3.21.12-11ubuntu3.1 | < 3.21.12-15ubuntu1

10 vendors · 124 products

References

52 links
Show all 52 references