Denial-of-Service Vulnerability in Google Protocol Buffers by Google
CVE-2026-0994

8.2HIGH

Key Information:

Vendor

Python

Status
Protobuf
Vendor
CVE Published:
23 January 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-0994?

A denial-of-service vulnerability has been identified in the Google Protocol Buffers library, specifically within the json_format.ParseDict() method in Python. This issue arises from a flaw in handling recursion depth when processing nested google.protobuf.Any messages. Attackers can craft deeply nested Any structures that exceed the allowable recursion depth, leading to a potential exhaustion of Python's recursion stack, ultimately resulting in a RecursionError. Proper safeguards and updates are necessary to mitigate this vulnerability.

Affected Version(s)

Protobuf <=v33.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

upb-any-recursion-audit
Created by Vardhan0257

References

https://github.com/protocolbuffers/protobuf/pull/25239

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.