CVE details
CVE-2026-0994
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
Affected ports (7)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| devel/protobuf | protobuf | 29.6,1 | unaddressed | sunpoet@FreeBSD.org |
| devel/protobuf-java | protobuf-java | 4.36.0 | unaddressed | atanubiswas484@gmail.com |
| devel/protobuf25 | protobuf25 | 2.5.0_5 | unaddressed | demon@FreeBSD.org |
| devel/protobuf3 | protobuf3 | 3.21.12 | unaddressed | sunpoet@FreeBSD.org |
| devel/py-protobuf | py312-protobuf | 7.36.2,1 | unaddressed | sunpoet@FreeBSD.org |
| devel/rubygem-google-protobuf | rubygem-google-protobuf | 4.36.2 | unaddressed | sunpoet@FreeBSD.org |
| devel/rubygem-google-protobuf-gitlab | rubygem-google-protobuf-gitlab | 4.36.1 | unaddressed | mfechner@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>protobuf</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>protobuf-java</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>protobuf25</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>protobuf3</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>py312-protobuf</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>rubygem-google-protobuf</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>rubygem-google-protobuf-gitlab</name>
<range><lt>FIXME</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A denial-of-service (DoS) vulnerability exists in
google.protobuf.json_format.ParseDict() in Python, where the
max_recursion_depth limit can be bypassed when parsing nested
google.protobuf.Any messages.
Due to missing recursion depth
accounting inside the internal Any-handling logic, an attacker can
supply deeply nested Any structures that bypass the intended recursion
limit, eventually exhausting Python’s recursion stack and causing a
RecursionError.</p>
</body>
</description>
<references>
<cvename>CVE-2026-0994</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-0994</url>
</references>
<dates>
<discovery>2026-01-23</discovery>
<entry>2026-10-25</entry>
</dates>
</vuln>