Skip to content
OpenAdvisories
High ELSA-2026-3095 1 CVE

Important: protobuf security update (Oracle Linux 9)

Published Feb 23, 2026 · Updated Feb 23, 2026

Ecosystem: Oracle Linux

Summary

[3.14.0-17]
- Fix CVE-2026-0994: nested Any messages bypassing recursion depth limits

Fixed packages 6

ReleasePackageFixed in
Oracle Linux · 9 protobuf 0:3.14.0-17.el9_7
Oracle Linux · 9 protobuf-compiler 0:3.14.0-17.el9_7
Oracle Linux · 9 protobuf-devel 0:3.14.0-17.el9_7
Oracle Linux · 9 protobuf-lite 0:3.14.0-17.el9_7
Oracle Linux · 9 protobuf-lite-devel 0:3.14.0-17.el9_7
Oracle Linux · 9 python3-protobuf 0:3.14.0-17.el9_7

Vulnerabilities 1

  • High 8.2
    CVE-2026-0994 Public exploit

    Denial of Service in Python Protobuf

    A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the int…

    Python Protobuf mysql open-webui Debian Ubuntu Azure Linux Wolfi PyPI