Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-0994: A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python's recursion stack and causing a RecursionError.
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | protobuf | 0:3.19.6-1.amzn2023.0.3 |
| Amazon Linux · 2023 | protobuf-compiler | 0:3.19.6-1.amzn2023.0.3 |
| Amazon Linux · 2023 | protobuf-compiler-debuginfo | 0:3.19.6-1.amzn2023.0.3 |
| Amazon Linux · 2023 | protobuf-debuginfo | 0:3.19.6-1.amzn2023.0.3 |
| Amazon Linux · 2023 | protobuf-debugsource | 0:3.19.6-1.amzn2023.0.3 |
| Amazon Linux · 2023 | protobuf-devel | 0:3.19.6-1.amzn2023.0.3 |
| Amazon Linux · 2023 | protobuf-emacs | 0:3.19.6-1.amzn2023.0.3 |
| Amazon Linux · 2023 | protobuf-lite | 0:3.19.6-1.amzn2023.0.3 |
| Amazon Linux · 2023 | protobuf-lite-debuginfo | 0:3.19.6-1.amzn2023.0.3 |
| Amazon Linux · 2023 | protobuf-lite-devel | 0:3.19.6-1.amzn2023.0.3 |
| Amazon Linux · 2023 | protobuf-lite-static | 0:3.19.6-1.amzn2023.0.3 |
| Amazon Linux · 2023 | protobuf-static | 0:3.19.6-1.amzn2023.0.3 |
| Amazon Linux · 2023 | protobuf-vim | 0:3.19.6-1.amzn2023.0.3 |
| Amazon Linux · 2023 | python3-protobuf | 0:3.19.6-1.amzn2023.0.3 |
| Amazon Linux · 2023 | python3-protobuf-debuginfo | 0:3.19.6-1.amzn2023.0.3 |
Vulnerabilities 1
-
High 8.2CVE-2026-0994 Public exploit
Denial of Service in Python Protobuf
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the int…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-0994.html