Executive Summary

This vulnerability is a denial-of-service (DoS) flaw in the Python protobuf library's json_format.ParseDict() function. It occurs because the recursion depth limit intended to prevent excessive recursion can be bypassed when parsing nested google.protobuf.Any messages. Specifically, the internal logic handling these nested Any messages does not properly track recursion depth, allowing an attacker to supply deeply nested structures that exhaust Python's recursion stack and cause a RecursionError, leading to a DoS condition. [1]

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this vulnerability by sending specially crafted deeply nested protobuf Any messages that bypass the recursion depth limit, causing the Python application to exhaust its recursion stack and crash with a RecursionError. This results in a denial-of-service condition, potentially disrupting service availability and causing application downtime. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for RecursionError exceptions in Python applications using google.protobuf.json_format.ParseDict() when processing nested google.protobuf.Any messages. Specifically, look for stack overflow or recursion depth exceeded errors during protobuf message parsing. There are no specific network commands provided, but reviewing application logs for RecursionError and testing with crafted deeply nested Any messages to trigger the error can help detect the issue. [1]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the protobuf Python library to the fixed version that includes the patch from pull request #25239, which ensures proper recursion depth accounting in parsing nested Any messages. This update prevents bypassing the max_recursion_depth limit and avoids denial-of-service via stack overflow. Until the update is applied, consider limiting or validating the depth of nested Any messages processed by your application to reduce risk. [1]

Useful 0 Not Useful 0