Skip to content
OpenAdvisories
High ELSA-2026-3094 1 CVE

Important: protobuf security update (Oracle Linux 10)

Published Feb 23, 2026 · Updated Feb 23, 2026

Ecosystem: Oracle Linux

Summary

[3.19.6-15]
- Fix CVE-2026-0994: nested Any messages bypassing recursion depth limits

[3.19.6-14]
- Disable tests during build that are flaky

[3.19.6-13]
- Rebuilt for tests directory

[3.19.6-12]
- Copy patch from c9s to make emacs dependency optional
Resolves: RHEL-93236

Fixed packages 6

ReleasePackageFixed in
Oracle Linux · 10 protobuf 0:3.19.6-15.el10_1
Oracle Linux · 10 protobuf-compiler 0:3.19.6-15.el10_1
Oracle Linux · 10 protobuf-devel 0:3.19.6-15.el10_1
Oracle Linux · 10 protobuf-lite 0:3.19.6-15.el10_1
Oracle Linux · 10 protobuf-lite-devel 0:3.19.6-15.el10_1
Oracle Linux · 10 python3-protobuf 0:3.19.6-15.el10_1

Vulnerabilities 1

  • High 8.2
    CVE-2026-0994 Public exploit

    Denial of Service in Python Protobuf

    A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the int…

    Python Protobuf mysql open-webui Debian Ubuntu Azure Linux Wolfi PyPI