protobuf affected by a JSON recursion depth bypass

A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages.Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supp...

aiop4 (>=0.1.0, <=0.3.0), autogluon (>=0.4.3b20220614, <=0.5.3b20221007) +17 more potentially affected by CVE-2026-0994 via protobuf (3.18.1)

protobuf PYPI version 3.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - aiop4 =0.1.0, =0.4.3b20220614, =0.4.3b20220616, =0.4.3b20220614, =1.4.0rc1.dev626, =0.0.5, =1.0.0, =1.0.0, =2.1.6, =2.0.9, =1.0.10, =9.0.0,...

aviatrix-migration-gcp (>=0.1.1, <=0.3.2), caraml-store (>=0.0.2, <=0.0.8) +9 more potentially affected by CVE-2026-0994 via protobuf (4.21.9)

protobuf PYPI version 4.21.9 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - aviatrix-migration-gcp =0.1.1, =0.0.2, =0.12.0rc6, =0.0.8, =2.0.0, =0.1.4.1, =14.2.0, =14.2.1 Source cves: CVE-2026-0994 Source advisory:...

c7n-gcp (0.4.26), robotframework-browser (16.2.0) potentially affected by CVE-2026-0994 via protobuf (4.23.1)

protobuf PYPI version 4.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - c7n-gcp 0.4.26 - robotframework-browser 16.2.0 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

py-model-versioning (>=0.4.0, <=0.5.0), qudi-iqo-modules (>=0.4.0, <=0.5.1) +3 more potentially affected by CVE-2026-0994 via protobuf (4.21.5)

protobuf PYPI version 4.21.5 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - py-model-versioning =0.4.0, =0.4.0, =0.0.2, =1.0.0, =2.14.6, =2.15.1 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

mospy-wallet (>=0.1.0, <=0.3.4) potentially affected by CVE-2026-0994 via protobuf (4.21.3)

protobuf PYPI version 4.21.3 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - mospy-wallet =0.1.0, =0.3.4 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

dftimewolf (20200608.0.0a0), drift-protocol (0.1.0) +7 more potentially affected by CVE-2026-0994 via protobuf (3.11.1)

protobuf PYPI version 3.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - dftimewolf 20200608.0.0a0 - drift-protocol 0.1.0 - drift-python-client =0.1.1, =0.0.1, =0.0.1, =5.8.8, =0.0.5, =0.0.11 Source cves: CVE-2026-09...

bigquery-fdw (>=2.1.1, <=2.1.2), bxsolana-trader (1.7.0) +6 more potentially affected by CVE-2026-0994 via protobuf (4.21.8)

protobuf PYPI version 4.21.8 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - bigquery-fdw =2.1.1, =0.0.13, =0.2.0, =0.0.2, =0.4.0, =0.2.0, =0.1.0, =0.1.1 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

designspark-cloud (22.11.0) potentially affected by CVE-2026-0994 via protobuf (3.20.1rc1)

protobuf PYPI version 3.20.1rc1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - designspark-cloud 22.11.0 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

neurocat (0.0.1), nevermined-metadata-driver-filecoin (>=0.1.0, <=0.2.1) +2 more potentially affected by CVE-2026-0994 via protobuf (3.15.1)

protobuf PYPI version 3.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - neurocat 0.0.1 - nevermined-metadata-driver-filecoin =0.1.0, =1.1.0, =1.2.2 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

mlagents (0.4.0), py-grpc-prometheus (0.0.2) +3 more potentially affected by CVE-2026-0994 via protobuf (3.5.2)

protobuf PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - mlagents 0.4.0 - py-grpc-prometheus 0.0.2 - pythongrpckit 0.0.3 - pythonkit =0.0.2, =0.0.3 - unityagents 0.4.0 Source cves: CVE-2026-0994 Source...

amazon-braket-algorithm-library (>=0.1.3, <=1.3.0), anx-interface (>=0.5.2, <=0.5.3) +27 more potentially affected by CVE-2026-0994 via protobuf (3.12.4)

protobuf PYPI version 3.12.4 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - amazon-braket-algorithm-library =0.1.3, =0.5.2, =1.4.0, =0.0.1, =0.8.2, =0.9.0.dev20200710225859, =0.0.3, =0.9.0rc0, =0.9.0rc0, =0.9.0rc0,...

PYSEC-2026-1805 protobuf affected by a JSON recursion depth bypass

A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can...

PYSEC-2026-1326 ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

Summary An integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. Details The bounds check ptr + fieldlength end in components/api/proto.cpp can overflow when a malicious client sends a large fieldlength value. This affects all...

ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

SummaryAn integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. DetailsThe bounds check ptr + fieldlength end in components/api/proto.cpp can overflow when a malicious client sends a large fieldlength value. This affects all...

protobuf-python has a potential Denial of Service issue

SummaryAny project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit.Reporter: Alexis Challande, Trail of Bits...

amazon-braket-algorithm-library (>=0.1.3, <=1.3.0), anx-interface (>=0.5.2, <=0.5.3) +27 more potentially affected by CVE-2025-4565 via protobuf (3.12.4)

protobuf PYPI version 3.12.4 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - amazon-braket-algorithm-library =0.1.3, =0.5.2, =1.4.0, =0.0.1, =0.8.2, =0.9.0.dev20200710225859, =0.0.3, =0.9.0rc0, =0.9.0rc0, =0.9.0rc0,...

blackfynn (>=2.4.1, <=3.0.0), dvc (>=0.8.2, <=0.8.6) potentially affected by CVE-2025-4565 via protobuf (3.2.0)

protobuf PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - blackfynn =2.4.1, =0.8.2, =0.8.6 Source cves: CVE-2025-4565 Source advisory: OSV:PYSEC-2026-1806...

worldengine (0.18.0) potentially affected by CVE-2025-4565 via protobuf (2.6.0)

protobuf PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - worldengine 0.18.0 Source cves: CVE-2025-4565 Source advisory: OSV:PYSEC-2026-1806...

remotivelabs-broker (0.2.0b12) potentially affected by CVE-2025-4565 via protobuf (3.19.2)

protobuf PYPI version 3.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - remotivelabs-broker 0.2.0b12 Source cves: CVE-2025-4565 Source advisory: OSV:PYSEC-2026-1806...