ROOT-APP-PYPI-CVE-2026-0994 CVE-2026-0994 in protobuf - Patched by Root

Root has patched CVE-2026-0994 in the protobuf package for Root:PyPI. Multiple fixed versions available...

Photon OS 5.0: Protobuf PHSA-2026-5.0-92-0949

An update of the protobuf package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0949. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Protobuf PHSA-2026-5.0-91-0825

An update of the protobuf package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0825. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in google.protobuf [CVE-2026-0994]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in google.protobuf, due to an issue that allows maxrecursiondepth limit to be bypassed when parsing nested google.protobuf.Any messages. CVE-2026-0994. Google.protobuf is used in our speech service runtimes. This...

dftimewolf (20200608.0.0a0), drift-protocol (0.1.0) +7 more potentially affected by CVE-2026-0994 via protobuf (3.11.1)

protobuf PYPI version 3.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - dftimewolf 20200608.0.0a0 - drift-protocol 0.1.0 - drift-python-client =0.1.1, =0.0.1, =0.0.1, =5.8.8, =0.0.5, =0.0.11 Source cves: CVE-2026-09...

arline-benchmarks (>=0.1.4, <=0.1.8), arline-quantum (>=0.1.4, <=0.1.8) +18 more potentially affected by CVE-2026-0994 via protobuf (3.8.0)

protobuf PYPI version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - arline-benchmarks =0.1.4, =0.1.4, =0.8.0, =0.8.0.dev20200123235114, =0.2.12, =0.5.1, =0.8.3.dev2, =0.0.1, =0.0.1, =0.1.0a23, =0.3.8273.dev0,...

blackfynn (>=2.4.1, <=3.0.0), dvc (>=0.8.2, <=0.8.6) potentially affected by CVE-2026-0994 via protobuf (3.2.0)

protobuf PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - blackfynn =2.4.1, =0.8.2, =0.8.6 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

abeja-sdk (>=2.2.0rc1, <=2.3.5rc1), accession (4.8.4) +353 more potentially affected by CVE-2026-0994 via protobuf (3.20.1)

protobuf PYPI version 3.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - abeja-sdk =2.2.0rc1, =0.8.3, =0.1.0, =0.0.0, =0.1.6, =0.10.0, =0.10.0, =3.5.4, =0.1.22, =7.0.2, =0.2.46, =0.2.56 and more Source cves:...

abeja-sdk (>=1.0.2rc1, <=1.0.2), adsmsg (>=1.1.2, <=1.1.5) +38 more potentially affected by CVE-2026-0994 via protobuf (3.11.3)

protobuf PYPI version 3.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - abeja-sdk =1.0.2rc1, =1.1.2, =0.0.2, =0.2.0, =1.1.1, =0.9.0.dev20200507040427, =0.1.0, =0.0.1, =0.5.0a0, =0.5.0a0.dev19, =0.17.0rc4, =0.17.0rc4...

a2 (>=0.1.0, <=0.8.3), abcdrl (>=0.2.0a0, <=0.2.0a4) +2451 more potentially affected by CVE-2026-0994 via protobuf (4.25.9)

protobuf PYPI version 4.25.9 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - a2 =0.1.0, =0.2.0a0, =0.1.0.dev2, =1.1.0, =2.0.0, =1.0.0, =0.1.0, =0.2.1, =0.9.0 and more Source cves: CVE-2026-0994 Source advisory:...

agxclick (>=0.1.36, <=0.4.1), ai2-tango (>=0.9.1, <=0.12.0) +104 more potentially affected by CVE-2026-0994 via protobuf (4.21.12)

protobuf PYPI version 4.21.12 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - agxclick =0.1.36, =0.9.1, =0.0.12, =1.0.10, =1.0.0b1, =0.8.0, =1.0.1, =22.9.5, =22.9.5, =23.3.2, =22.9.5, =22.9.5, =22.9.5, =23.3.12 and more...

asc (>=0.1.0, <=0.3.1), candig-ingest (>=1.3.1, <=1.5.0) +6 more potentially affected by CVE-2026-0994 via protobuf (3.3.0)

protobuf PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - asc =0.1.0, =1.3.1, =1.0.1, =1.2.3, =2018.1.0, =0.0.0.dev1, =0.0.0.dev37 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

admobilizeapis (>=0.0.5, <=0.0.7), c3-reference (1.8.1) +8 more potentially affected by CVE-2026-0994 via protobuf (3.6.0)

protobuf PYPI version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - admobilizeapis =0.0.5, =1.1.4, =1.0.5, =1.9.1, =1.10.0 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

bq-jobrunner (0.0.1), libp2p (>=0.1.1, <=0.1.2) +6 more potentially affected by CVE-2026-0994 via protobuf (3.9.0)

protobuf PYPI version 3.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - bq-jobrunner 0.0.1 - libp2p =0.1.1, =1.0.6, =0.0.20, =0.1.0a31, =1.2.0rc2, =1.2.0rc3, =1.2.0 Source cves: CVE-2026-0994 Source advisory:...

abba-python (>=0.1.6, <=0.3.0), ablation (0.1.0) +187 more potentially affected by CVE-2026-0994 via protobuf (3.20.0)

protobuf PYPI version 3.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - abba-python =0.1.6, =1.0.43, =0.3.1a1, =1.0.0, =0.1.0b5, =0.0.5, =0.1.1, =0.3.0, =0.1.11, =0.1.1, =0.2.3.4 and more Source cves: CVE-2026-0994...

aquests (>=0.7.8.5b1, <=0.7.15.7), dnntools (0.1.4) +10 more potentially affected by CVE-2026-0994 via protobuf (3.1.0.post1)

protobuf PYPI version 3.1.0.post1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - aquests =0.7.8.5b1, =0.1.8a1, =0.1.0, =0.1.0, =0.1.5, =0.1.6 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

pybfe (>=2020.8.13.285, <=2020.12.23.630) potentially affected by CVE-2026-0994 via protobuf (3.12.0rc2)

protobuf PYPI version 3.12.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - pybfe =2020.8.13.285, =2020.12.23.630 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

cloudscript (0.0.1), cloudview (0.3.2) +21 more potentially affected by CVE-2026-0994 via protobuf (3.10.0)

protobuf PYPI version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - cloudscript 0.0.1 - cloudview 0.3.2 - comics-down 0.2.0 - dataclay =1.0.7.dev20200310, =20210310.0.0, =2.3.0rc2, =1.1.0, =1.14.0b1, =0.0.1,...

c7n-gcp (0.4.30), cloudquery-plugin-sdk (>=0.1.2, <=0.1.3) +16 more potentially affected by CVE-2026-0994 via protobuf (4.24.2)

protobuf PYPI version 4.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - c7n-gcp 0.4.30 - cloudquery-plugin-sdk =0.1.2, =1.0.1, =1.0.0, =0.1.2, =0.0.3, =0.1.7, =0.7.0b5, =1.0.14, =0.1.2.dev0, =0.0.19, =0.3.0b6, =0.4....

aaa-ml-datasets-course (1.0.0), adstoolbox (>=2026.2.10.1, <=2026.5.19) +109 more potentially affected by CVE-2026-0994 via protobuf (4.25.3)

protobuf PYPI version 4.25.3 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - aaa-ml-datasets-course 1.0.0 - adstoolbox =2026.2.10.1, =0.1.1, =0.0.2, =0.0.1b1, =0.9.9, =0.3.5, =0.0.1, =0.5.5.post5, =0.5.5.post4, =2.4.0,...