Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:pypi/protobuf@6.33.5

Type pypi

Namespace

Name protobuf

Version 6.33.5

Qualifiers

Subpath

Is_vulnerable false

Next_non_vulnerable_version null

Latest_non_vulnerable_version null

Affected_by_vulnerabilities

Fixing_vulnerabilities

url VCID-u1c9-xd6h-8fgc

vulnerability_id VCID-u1c9-xd6h-8fgc

summary

protobuf affected by a JSON recursion depth bypass
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

references

reference_url	https://github.com/protocolbuffers/protobuf
reference_id
reference_type
scores
url	https://github.com/protocolbuffers/protobuf

reference_url	https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf
reference_id
reference_type
scores
url	https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf

reference_url	https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b
reference_id
reference_type
scores
url	https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b

reference_url	https://github.com/protocolbuffers/protobuf/issues/25070
reference_id
reference_type
scores
url	https://github.com/protocolbuffers/protobuf/issues/25070

reference_url	https://github.com/protocolbuffers/protobuf/pull/25239
reference_id
reference_type
scores
url	https://github.com/protocolbuffers/protobuf/pull/25239

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2026-0994
reference_id	CVE-2026-0994
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2026-0994

reference_url	https://github.com/advisories/GHSA-7gcm-g887-7qv7
reference_id	GHSA-7gcm-g887-7qv7
reference_type
scores
url	https://github.com/advisories/GHSA-7gcm-g887-7qv7

fixed_packages

url	pkg:pypi/protobuf@5.29.6
purl	pkg:pypi/protobuf@5.29.6
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/protobuf@5.29.6

url	pkg:pypi/protobuf@6.33.5
purl	pkg:pypi/protobuf@6.33.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/protobuf@6.33.5

aliases CVE-2026-0994, GHSA-7gcm-g887-7qv7

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-u1c9-xd6h-8fgc

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/protobuf@6.33.5

Package Instance