CVE-2026-0994

Publication date 23 January 2026

Last updated 27 February 2026

Ubuntu priority

Description

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
protobuf	25.10 questing	Fixed 3.21.12-11ubuntu3.1
	24.04 LTS noble	Fixed 3.21.12-8.2ubuntu0.3
	22.04 LTS jammy	Fixed 3.12.4-1ubuntu7.22.04.6
	20.04 LTS focal	Vulnerable
	18.04 LTS bionic	Vulnerable
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
protobuf	Upstream: d2b0016

References

Related Ubuntu Security Notices (USN)

USN-8063-1
Protocol Buffers vulnerability
25 February 2026