Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/protobuf@6.32.0rc2
purl pkg:pypi/protobuf@6.32.0rc2
Next non-vulnerable version 6.33.5
Latest non-vulnerable version 7.34.0rc1
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-cg4f-vq8p-dub3
Aliases:
CVE-2026-0994
GHSA-7gcm-g887-7qv7
protobuf affected by a JSON recursion depth bypass A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
6.33.5
Affected by 0 other vulnerabilities.
7.34.0rc1
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-17T00:12:00.075364+00:00 GitLab Importer Affected by VCID-cg4f-vq8p-dub3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/protobuf/CVE-2026-0994.yml 38.4.0
2026-04-12T01:35:47.579437+00:00 GitLab Importer Affected by VCID-cg4f-vq8p-dub3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/protobuf/CVE-2026-0994.yml 38.3.0
2026-04-03T01:44:48.511263+00:00 GitLab Importer Affected by VCID-cg4f-vq8p-dub3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/protobuf/CVE-2026-0994.yml 38.1.0