Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-u1c9-xd6h-8fgc

Summary

protobuf affected by a JSON recursion depth bypass
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

Aliases

alias	CVE-2026-0994

alias	GHSA-7gcm-g887-7qv7

Fixed_packages

url	pkg:pypi/protobuf@5.29.6
purl	pkg:pypi/protobuf@5.29.6
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/protobuf@5.29.6

url	pkg:pypi/protobuf@6.33.5
purl	pkg:pypi/protobuf@6.33.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/protobuf@6.33.5

Affected_packages

url pkg:pypi/protobuf@6.30.0rc1

purl pkg:pypi/protobuf@6.30.0rc1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-u1c9-xd6h-8fgc

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/protobuf@6.30.0rc1

References

reference_url	https://github.com/protocolbuffers/protobuf
reference_id
reference_type
scores
url	https://github.com/protocolbuffers/protobuf

reference_url	https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf
reference_id
reference_type
scores
url	https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf

reference_url	https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b
reference_id
reference_type
scores
url	https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b

reference_url	https://github.com/protocolbuffers/protobuf/issues/25070
reference_id
reference_type
scores
url	https://github.com/protocolbuffers/protobuf/issues/25070

reference_url	https://github.com/protocolbuffers/protobuf/pull/25239
reference_id
reference_type
scores
url	https://github.com/protocolbuffers/protobuf/pull/25239

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2026-0994
reference_id	CVE-2026-0994
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2026-0994

reference_url	https://github.com/advisories/GHSA-7gcm-g887-7qv7
reference_id	GHSA-7gcm-g887-7qv7
reference_type
scores
url	https://github.com/advisories/GHSA-7gcm-g887-7qv7

Weaknesses

cwe_id	674
name	Uncontrolled Recursion
description	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-u1c9-xd6h-8fgc

Vulnerability Instance