Summary
The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data.
Security Fix(es):
* python: protobuf: Protobuf: Denial of Service due to recursion depth bypass (CVE-2026-0994)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | protobuf | 3.14.0-17.el9_7 |
| AlmaLinux · 9 | protobuf-compiler | 3.14.0-17.el9_7 |
| AlmaLinux · 9 | protobuf-devel | 3.14.0-17.el9_7 |
| AlmaLinux · 9 | protobuf-lite | 3.14.0-17.el9_7 |
| AlmaLinux · 9 | protobuf-lite-devel | 3.14.0-17.el9_7 |
| AlmaLinux · 9 | python3-protobuf | 3.14.0-17.el9_7 |
Vulnerabilities 1
-
High 8.2CVE-2026-0994 Public exploit
Denial of Service in Python Protobuf
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the int…