Summary
It was discovered that Protocol Buffers incorrectly handled recursion when
the Python google.protobuf.json_format.ParseDict() function is being used.
An attacker could possibly use this issue to cause Protocol Buffers to
consume resources, resulting in a denial of service.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | protobuf | 3.12.4-1ubuntu7.22.04.6 |
| Ubuntu · 24.04 LTS 24.04:LTS | protobuf | 3.21.12-8.2ubuntu0.3 |
| Ubuntu · 25.10 | protobuf | 3.21.12-11ubuntu3.1 |
References
-
report
https://ubuntu.com/security/CVE-2026-0994