mospy-wallet (>=0.1.0, <=0.3.4) potentially affected by CVE-2026-0994 via protobuf (4.21.3)

protobuf PYPI version 4.21.3 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - mospy-wallet =0.1.0, =0.3.4 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

datasaku (0.0.8), dovesnap (>=1.1.11, <=1.1.12) +13 more potentially affected by CVE-2026-0994 via protobuf (4.23.0)

protobuf PYPI version 4.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - datasaku 0.0.8 - dovesnap =1.1.11, =0.105.0rc2, =0.10.0rc1, =2.2.12, =15.32.0, =3.25.0, =1.7.0, =3.0.0, =0.8.0rc1, =0.10.0rc1, =0.10.0 -...

Uncontrolled Recursion

Overview protobuf is a Google’s data interchange format Affected versions of this package are vulnerable to Uncontrolled Recursion in the ParseDict function, when handling deeply nested google.protobuf.Any messages. An attacker can bypass maxrecursiondepth to exhaust the recursion stack and trigg...

ak-gpapi (>=3.0.4, <=3.0.8), angorapy (>=0.8.0, <=0.8.1) +27 more potentially affected by CVE-2026-0994 via protobuf (3.19.0)

protobuf PYPI version 3.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - ak-gpapi =3.0.4, =0.8.0, =0.1.0, =1.0.1, =0.0.6, =0.6.5, =0.0.1, =1.1.0, =1.1.0, =0.0.4, =0.2.1 and more Source cves: CVE-2026-0994 Source...

coinlib (>=1.0.6, <=1.0.7), wave-api (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-0994 via protobuf (3.15.3)

protobuf PYPI version 3.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - coinlib =1.0.6, =0.1.0, =0.1.2 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

GHSA-7GCM-G887-7QV7 protobuf affected by a JSON recursion depth bypass

A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can...

c7n-gcp (0.4.30), cloudquery-plugin-sdk (>=0.1.2, <=0.1.3) +16 more potentially affected by CVE-2026-0994 via protobuf (4.24.2)

protobuf PYPI version 4.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - c7n-gcp 0.4.30 - cloudquery-plugin-sdk =0.1.2, =1.0.1, =1.0.0, =0.1.2, =0.0.3, =0.1.7, =0.7.0b5, =1.0.14, =0.1.2.dev0, =0.0.19, =0.3.0b6, =0.4....

neurocat (0.0.1), nevermined-metadata-driver-filecoin (>=0.1.0, <=0.2.1) +2 more potentially affected by CVE-2026-0994 via protobuf (3.15.1)

protobuf PYPI version 3.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - neurocat 0.0.1 - nevermined-metadata-driver-filecoin =0.1.0, =1.1.0, =1.2.2 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

aiop4 (>=0.1.0, <=0.3.0), autogluon (>=0.4.3b20220614, <=0.5.3b20221007) +17 more potentially affected by CVE-2026-0994 via protobuf (3.18.1)

protobuf PYPI version 3.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - aiop4 =0.1.0, =0.4.3b20220614, =0.4.3b20220616, =0.4.3b20220614, =1.4.0rc1.dev626, =0.0.5, =1.0.0, =1.0.0, =2.1.6, =2.0.9, =1.0.10, =9.0.0,...

adsmsg (>=1.2.0, <=1.3.1), alphalogic-api3 (>=0.0.1, <=0.1.5) +62 more potentially affected by CVE-2026-0994 via protobuf (3.14.0)

protobuf PYPI version 3.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - adsmsg =1.2.0, =0.0.1, =0.1.0, =0.7.2b4, =0.0.1, =1.47.0, =0.0.1.dev50, =1.0.2, =0.4.8, =0.3.5, =2.0.3, =0.1.1, =0.9.1, =0.9.4 and more Source...

mlagents (0.4.0), py-grpc-prometheus (0.0.2) +3 more potentially affected by CVE-2026-0994 via protobuf (3.5.2)

protobuf PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - mlagents 0.4.0 - py-grpc-prometheus 0.0.2 - pythongrpckit 0.0.3 - pythonkit =0.0.2, =0.0.3 - unityagents 0.4.0 Source cves: CVE-2026-0994 Source...

cloudscript (0.0.1), cloudview (0.3.2) +20 more potentially affected by CVE-2026-0994 via protobuf (3.10.0)

protobuf PYPI version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - cloudscript 0.0.1 - cloudview 0.3.2 - comics-down 0.2.0 - dataclay =1.0.7.dev20200310, =20210310.0.0, =2.3.0rc2, =1.14.0b1, =0.0.1, =5.0.0,...

eqcctpro (>=0.3.0, <=0.6.1), ingestr (>=0.13.18, <=0.14.122) potentially affected by CVE-2026-0994 via protobuf (4.25.6)

protobuf PYPI version 4.25.6 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - eqcctpro =0.3.0, =0.13.18, =0.14.122 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

c7n-gcp (>=0.4.18, <=0.4.19), c7n-mailer (0.6.18) +12 more potentially affected by CVE-2026-0994 via protobuf (4.21.7)

protobuf PYPI version 4.21.7 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - c7n-gcp =0.4.18, =2.7.0, =1.8.0rc1.dev1270, =0.3.1, =3.0.0, =1.0.0, =0.1.0, =0.1.1, =2.0.0.dev89, =0.0.1, =2.0.1 Source cves: CVE-2026-0994...

a2a-sdk (0.2.8), a7p (>=1.0.1rc2, <=1.0.2) +247 more potentially affected by CVE-2026-0994 via protobuf (>=6.30.0, <=6.33.4)

protobuf PYPI version =6.30.0, =1.0.1rc2, =0.1.3, =2025.12.2.2, =0.4.0rc1, =1.0.0, =1.0.29, =25.6.0b2, =1.2.0, =0.1.0, =0.2.1b20230930, =0.0.32, =1.3.0.dev4, =1.3.0 and more Source cves: CVE-2026-0994 Source advisory: GHSA-7GCM-G887-7QV7...

nucypher (6.0.0) potentially affected by CVE-2026-0994 via protobuf (3.20.0rc1)

protobuf PYPI version 3.20.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - nucypher 6.0.0 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

cogdata (>=0.0.6, <=0.0.7), icetk (>=0.0.5, <=0.0.7) +3 more potentially affected by CVE-2026-0994 via protobuf (3.19.0rc2)

protobuf PYPI version 3.19.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - cogdata =0.0.6, =0.0.5, =3.0.0a2, =4.7.2 - motion-master-proto 5.2.0 - tensorflow-checkpoint-reader 0.1.2 Source cves: CVE-2026-0994 Source...

alpha-data-py (>=1.0.0, <=1.0.9), beeper-hangups (>=0.5.0a1, <=0.5.0a5) +7 more potentially affected by CVE-2026-0994 via protobuf (3.16.0)

protobuf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - alpha-data-py =1.0.0, =0.5.0a1, =0.0.34, =0.20.5rc3, =0.2.0b1, =0.1.1.1, =4.4.0, =1.0.0, =1.0.1 Source cves: CVE-2026-0994 Source advisory:...

aaa-ml-datasets-course (1.0.0), adstoolbox (>=2026.2.10.1, <=2026.5.19) +109 more potentially affected by CVE-2026-0994 via protobuf (4.25.3)

protobuf PYPI version 4.25.3 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - aaa-ml-datasets-course 1.0.0 - adstoolbox =2026.2.10.1, =0.1.1, =0.0.2, =0.0.1b1, =0.9.9, =0.3.5, =0.0.1, =0.5.5.post5, =0.5.5.post4, =2.4.0,...

nucypher (>=0.1.0a29, <=1.2.0b1) potentially affected by CVE-2026-0994 via protobuf (3.10.0rc1)

protobuf PYPI version 3.10.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - nucypher =0.1.0a29, =1.2.0b1 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...