a2a-sdk (0.2.8), a7p (>=1.0.1rc2, <=1.0.2) +247 more potentially affected by CVE-2026-0994 via protobuf (>=6.30.0, <=6.33.4)

protobuf PYPI version =6.30.0, =1.0.1rc2, =0.1.3, =2025.12.2.2, =0.4.0rc1, =1.0.0, =1.0.29, =25.6.0b2, =1.2.0, =0.1.0, =0.2.1b20230930, =0.0.32, =1.3.0.dev4, =1.3.0 and more Source cves: CVE-2026-0994 Source advisory: GHSA-7GCM-G887-7QV7...

a2a-sdk (>=0.2.9, <=0.3.0), a2anet (>=0.0.5, <=0.2.0) +440 more potentially affected by CVE-2026-0994 via protobuf (>=5.26.0rc2, <=5.29.5)

protobuf PYPI version =5.26.0rc2, =0.2.9, =0.0.5, =1.0.0, =0.1.0, =0.87.2.dev9, =0.82.3, =0.1.0.dev19, =0.0.1rc15474277, =2.47.9, =0.0.0b1, =0.1.0, =0.1.8, =0.0.10, =0.0.19 and more Source cves: CVE-2026-0994 Source advisory: SNYK:PYTHON-PROTOBUF-15090738...

fancy-nlp (>=0.0.1, <=0.0.4), gm (>=3.0.0.82, <=3.0.0.107) +3 more potentially affected by CVE-2026-0994 via protobuf (3.4.0)

protobuf PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - fancy-nlp =0.0.1, =3.0.0.82, =0.0.1, =1.0.0, =0.3.4.2, =0.3.5 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

c7n-gcp (0.4.30), cloudquery-plugin-sdk (>=0.1.2, <=0.1.3) +16 more potentially affected by CVE-2026-0994 via protobuf (4.24.2)

protobuf PYPI version 4.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - c7n-gcp 0.4.30 - cloudquery-plugin-sdk =0.1.2, =1.0.1, =1.0.0, =0.1.2, =0.0.3, =0.1.7, =0.7.0b5, =1.0.14, =0.1.2.dev0, =0.0.19, =0.3.0b6, =0.4....

bt-test-interfaces (>=0.0.1, <=0.0.2), cloudone-vsapi (>=1.0.0, <=1.0.4) +11 more potentially affected by CVE-2026-0994 via protobuf (4.22.0)

protobuf PYPI version 4.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - bt-test-interfaces =0.0.1, =1.0.0, =0.11.4, =1.1.6.dev0, =0.9.6, =0.22.48, =0.7.3, =1.0.6, =1.0.0, =1.0.15, =3.3.2 Source cves: CVE-2026-0994...

nucypher (6.0.0) potentially affected by CVE-2026-0994 via protobuf (3.20.0rc1)

protobuf PYPI version 3.20.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - nucypher 6.0.0 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

adsmsg (>=1.2.0, <=1.3.1), alphalogic-api3 (>=0.0.1, <=0.1.5) +62 more potentially affected by CVE-2026-0994 via protobuf (3.14.0)

protobuf PYPI version 3.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - adsmsg =1.2.0, =0.0.1, =0.1.0, =0.7.2b4, =0.0.1, =1.47.0, =0.0.1.dev50, =1.0.2, =0.4.8, =0.3.5, =2.0.3, =0.1.1, =0.9.1, =0.9.4 and more Source...

cogdata (>=0.0.6, <=0.0.7), icetk (>=0.0.5, <=0.0.7) +3 more potentially affected by CVE-2026-0994 via protobuf (3.19.0rc2)

protobuf PYPI version 3.19.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - cogdata =0.0.6, =0.0.5, =3.0.0a2, =4.7.2 - motion-master-proto 5.2.0 - tensorflow-checkpoint-reader 0.1.2 Source cves: CVE-2026-0994 Source...

2404-segmentation-pipeline (>=0.1.0, <=1.0.0), apache-beam (>=2.48.0, <=2.50.0) +83 more potentially affected by CVE-2026-0994 via protobuf (4.23.4)

protobuf PYPI version 4.23.4 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - 2404-segmentation-pipeline =0.1.0, =2.48.0, =1.17.2, =1.0.2, =0.6.14, =23.9.0, =23.9.0, =23.9.0, =23.9.0a1, =23.9.0a1, =23.9.6, =23.9.0a1,...

cloudscript (0.0.1), cloudview (0.3.2) +20 more potentially affected by CVE-2026-0994 via protobuf (3.10.0)

protobuf PYPI version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - cloudscript 0.0.1 - cloudview 0.3.2 - comics-down 0.2.0 - dataclay =1.0.7.dev20200310, =20210310.0.0, =2.3.0rc2, =1.14.0b1, =0.0.1, =5.0.0,...

adsmsg (>=1.3.3, <=1.3.19), algo-bus-sdk (>=0.0.1, <=0.0.9) +77 more potentially affected by CVE-2026-0994 via protobuf (3.17.3)

protobuf PYPI version 3.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - adsmsg =1.3.3, =0.0.1, =0.0.3, =0.4.9, =1.1.1, =2.1.1, =0.2.1, =0.4.11, =0.0.0rc24, =2.0.0, =1.3.0rc1, =1.3.0rc1.dev588, =0.0.12, =0.1.4 and mo...

GHSA-7GCM-G887-7QV7 protobuf affected by a JSON recursion depth bypass

A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can...

chemtsv2 (>=0.9.1, <=0.9.13), cohesion-pipeline (0.1.2) +8 more potentially affected by CVE-2026-0994 via protobuf (3.9.2)

protobuf PYPI version 3.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - chemtsv2 =0.9.1, =0.8.6, =0.8.7 - nerdvision 1.0.1 - pycloud-client 0.7.1 - qihoo-tensornet 0.208.0 - transactid 0.1.0a3 - zeebe-grpc 0.20.0.11...

ai-flow (0.3.1), ai-flow-nightly (>=2022.9.19, <=2023.12.31) +19 more potentially affected by CVE-2026-0994 via protobuf (3.15.6)

protobuf PYPI version 3.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - ai-flow 0.3.1 - ai-flow-nightly =2022.9.19, =0.1.0.2, =3.0.8rc6, =1.0.9, =0.0.1, =1.17.0b1, =1.14.0, =0.3.1, =0.3.73, =0.1.0, =2022.9.19,...

bunnieinfra (>=0.1.0, <=0.1.4), iconrpcserver (>=1.2.10, <=1.4.9) +2 more potentially affected by CVE-2026-0994 via protobuf (3.7.0)

protobuf PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - bunnieinfra =0.1.0, =1.2.10, =0.1.0.dev0, =0.1.17.dev0 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

protobuf affected by a JSON recursion depth bypass

A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can...

aissemble-machine-learning-training (>=1.13.0rc1, <=2.0.0), aissemble-machine-learning-training-base (>=1.13.0rc1, <=2.0.0) +9 more potentially affected by CVE-2026-0994 via protobuf (4.25.8)

protobuf PYPI version 4.25.8 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - aissemble-machine-learning-training =1.13.0rc1, =1.13.0rc1, =1.1.0, =1.1.51, =0.6.2, =0.4.6, =0.17.3rc10, =0.2.0, =5.19.8, =4.0.0rc0, =4.1.0...

rarecrowds (>=0.0.1, <=0.0.5), sage-engine (2.3.0) +1 more potentially affected by CVE-2026-0994 via protobuf (3.15.7)

protobuf PYPI version 3.15.7 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - rarecrowds =0.0.1, =0.0.5 - sage-engine 2.3.0 - training-grounds 0.0.2 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

arize (>=1.0.4, <=2.1.11), c7n-gcp (0.4.1) +1 more potentially affected by CVE-2026-0994 via protobuf (3.12.0)

protobuf PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - arize =1.0.4, =2.1.11 - c7n-gcp 0.4.1 - wirepas-mesh-messaging 1.2.0 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

aquests (>=0.7.16.17, <=0.7.16.18), backend-ai-common (1.3.1) +6 more potentially affected by CVE-2026-0994 via protobuf (3.5.2.post1)

protobuf PYPI version 3.5.2.post1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - aquests =0.7.16.17, =1.3.2, =1.1.0, =0.4.1, =0.0.4, =0.8.2, =0.11.0 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...