CVE-2026-0994
Denial-of-Service in Python google.protobuf.json_format via Recursion Bypass
Publication date: 2026-01-23
Last updated on: 2026-04-09
Assigner: Google Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| protobuf | to 33.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-674 | The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a denial-of-service (DoS) flaw in the Python protobuf library's json_format.ParseDict() function. It occurs because the recursion depth limit intended to prevent excessive recursion can be bypassed when parsing nested google.protobuf.Any messages. Specifically, the internal logic handling these nested Any messages does not properly track recursion depth, allowing an attacker to supply deeply nested structures that exhaust Python's recursion stack and cause a RecursionError, leading to a DoS condition. [1]
How can this vulnerability impact me? :
An attacker can exploit this vulnerability by sending specially crafted deeply nested protobuf Any messages that bypass the recursion depth limit, causing the Python application to exhaust its recursion stack and crash with a RecursionError. This results in a denial-of-service condition, potentially disrupting service availability and causing application downtime. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for RecursionError exceptions in Python applications using google.protobuf.json_format.ParseDict() when processing nested google.protobuf.Any messages. Specifically, look for stack overflow or recursion depth exceeded errors during protobuf message parsing. There are no specific network commands provided, but reviewing application logs for RecursionError and testing with crafted deeply nested Any messages to trigger the error can help detect the issue. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the protobuf Python library to the fixed version that includes the patch from pull request #25239, which ensures proper recursion depth accounting in parsing nested Any messages. This update prevents bypassing the max_recursion_depth limit and avoids denial-of-service via stack overflow. Until the update is applied, consider limiting or validating the depth of nested Any messages processed by your application to reduce risk. [1]