Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:pypi/protobuf@7.34.0rc1

Type pypi

Namespace

Name protobuf

Version 7.34.0rc1

Qualifiers

Subpath

Is_vulnerable false

Next_non_vulnerable_version null

Latest_non_vulnerable_version null

Affected_by_vulnerabilities

Fixing_vulnerabilities

url VCID-u1c9-xd6h-8fgc

vulnerability_id VCID-u1c9-xd6h-8fgc

summary

protobuf affected by a JSON recursion depth bypass
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

references

reference_url

https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-0994.json

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

url

https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-0994.json

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2026-0994

reference_id

reference_type

scores

value	0.00013
scoring_system	epss
scoring_elements	0.02506
published_at	2026-06-05T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2026-0994

reference_url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0994
reference_id
reference_type
scores
url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0994

reference_url

https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml

reference_id

reference_type

scores

value	5.9
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

url

https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml

reference_url

https://github.com/protocolbuffers/protobuf

reference_id

reference_type

scores

value	8.2
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/protocolbuffers/protobuf

reference_url

https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf

reference_id

reference_type

scores

value	8.2
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf

reference_url

https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b

reference_id

reference_type

scores

value	8.2
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b

reference_url

https://github.com/protocolbuffers/protobuf/issues/25070

reference_id

reference_type

scores

value	8.2
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/protocolbuffers/protobuf/issues/25070

reference_url

https://github.com/protocolbuffers/protobuf/pull/25239

reference_id

reference_type

scores

value	8.2
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

value	HIGH
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-23T15:33:48Z/

url

https://github.com/protocolbuffers/protobuf/pull/25239

reference_url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126302
reference_id	1126302
reference_type
scores
url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126302

reference_url	https://bugzilla.redhat.com/show_bug.cgi?id=2432398
reference_id	2432398
reference_type
scores
url	https://bugzilla.redhat.com/show_bug.cgi?id=2432398

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2026-0994

reference_id

CVE-2026-0994

reference_type

scores

value	8.2
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2026-0994

reference_url

https://github.com/advisories/GHSA-7gcm-g887-7qv7

reference_id

GHSA-7gcm-g887-7qv7

reference_type

scores

value	HIGH
scoring_system	cvssv3.1_qr
scoring_elements

url

https://github.com/advisories/GHSA-7gcm-g887-7qv7

reference_url	https://access.redhat.com/errata/RHSA-2026:16174
reference_id	RHSA-2026:16174
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2026:16174

reference_url	https://access.redhat.com/errata/RHSA-2026:3059
reference_id	RHSA-2026:3059
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2026:3059

reference_url	https://access.redhat.com/errata/RHSA-2026:3094
reference_id	RHSA-2026:3094
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2026:3094

reference_url	https://access.redhat.com/errata/RHSA-2026:3095
reference_id	RHSA-2026:3095
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2026:3095

reference_url	https://access.redhat.com/errata/RHSA-2026:3097
reference_id	RHSA-2026:3097
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2026:3097

reference_url	https://access.redhat.com/errata/RHSA-2026:3218
reference_id	RHSA-2026:3218
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2026:3218

reference_url	https://access.redhat.com/errata/RHSA-2026:3219
reference_id	RHSA-2026:3219
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2026:3219

reference_url	https://access.redhat.com/errata/RHSA-2026:3220
reference_id	RHSA-2026:3220
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2026:3220

reference_url	https://access.redhat.com/errata/RHSA-2026:3461
reference_id	RHSA-2026:3461
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2026:3461

reference_url	https://access.redhat.com/errata/RHSA-2026:3462
reference_id	RHSA-2026:3462
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2026:3462

reference_url	https://access.redhat.com/errata/RHSA-2026:3958
reference_id	RHSA-2026:3958
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2026:3958

reference_url	https://access.redhat.com/errata/RHSA-2026:3959
reference_id	RHSA-2026:3959
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2026:3959

reference_url	https://access.redhat.com/errata/RHSA-2026:8746
reference_id	RHSA-2026:8746
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2026:8746

reference_url	https://access.redhat.com/errata/RHSA-2026:8747
reference_id	RHSA-2026:8747
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2026:8747

reference_url	https://access.redhat.com/errata/RHSA-2026:8748
reference_id	RHSA-2026:8748
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2026:8748

reference_url	https://usn.ubuntu.com/8063-1/
reference_id	USN-8063-1
reference_type
scores
url	https://usn.ubuntu.com/8063-1/

reference_url	https://usn.ubuntu.com/8063-2/
reference_id	USN-8063-2
reference_type
scores
url	https://usn.ubuntu.com/8063-2/

fixed_packages

url	pkg:pypi/protobuf@5.29.6
purl	pkg:pypi/protobuf@5.29.6
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/protobuf@5.29.6

url	pkg:pypi/protobuf@6.33.5
purl	pkg:pypi/protobuf@6.33.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/protobuf@6.33.5

url	pkg:pypi/protobuf@7.34.0rc1
purl	pkg:pypi/protobuf@7.34.0rc1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/protobuf@7.34.0rc1

aliases CVE-2026-0994, GHSA-7gcm-g887-7qv7

risk_score 4.0

exploitability 0.5

weighted_severity 8.0

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-u1c9-xd6h-8fgc

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/protobuf@7.34.0rc1

Package Instance