Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/protobuf@6.33.5
purl pkg:pypi/protobuf@6.33.5
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-cg4f-vq8p-dub3 protobuf affected by a JSON recursion depth bypass A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError. CVE-2026-0994
GHSA-7gcm-g887-7qv7

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T16:07:49.270522+00:00 GHSA Importer Fixing VCID-cg4f-vq8p-dub3 https://github.com/advisories/GHSA-7gcm-g887-7qv7 38.0.0
2026-04-01T12:53:43.520356+00:00 GitLab Importer Fixing VCID-cg4f-vq8p-dub3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/protobuf/CVE-2026-0994.yml 38.0.0
2026-04-01T12:52:23.327868+00:00 GithubOSV Importer Fixing VCID-cg4f-vq8p-dub3 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7gcm-g887-7qv7/GHSA-7gcm-g887-7qv7.json 38.0.0