Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/protobuf@7.34.0rc1
purl pkg:pypi/protobuf@7.34.0rc1
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-cg4f-vq8p-dub3 protobuf affected by a JSON recursion depth bypass A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError. CVE-2026-0994
GHSA-7gcm-g887-7qv7

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-17T00:12:00.109721+00:00 GitLab Importer Fixing VCID-cg4f-vq8p-dub3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/protobuf/CVE-2026-0994.yml 38.4.0
2026-04-12T01:35:47.614713+00:00 GitLab Importer Fixing VCID-cg4f-vq8p-dub3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/protobuf/CVE-2026-0994.yml 38.3.0
2026-04-03T01:44:48.555302+00:00 GitLab Importer Fixing VCID-cg4f-vq8p-dub3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/protobuf/CVE-2026-0994.yml 38.1.0