mlagents (0.4.0), py-grpc-prometheus (0.0.2) +3 more potentially affected by CVE-2026-0994 via protobuf (3.5.2)

protobuf PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - mlagents 0.4.0 - py-grpc-prometheus 0.0.2 - pythongrpckit 0.0.3 - pythonkit =0.0.2, =0.0.3 - unityagents 0.4.0 Source cves: CVE-2026-0994 Source...

a2a-sdk (>=0.2.9, <=0.3.0), a2anet (>=0.0.5, <=0.2.0) +440 more potentially affected by CVE-2026-0994 via protobuf (>=5.26.0rc2, <=5.29.5)

protobuf PYPI version =5.26.0rc2, =0.2.9, =0.0.5, =1.0.0, =0.1.0, =0.87.2.dev9, =0.82.3, =0.1.0.dev19, =0.0.1rc15474277, =2.47.9, =0.0.0b1, =0.1.0, =0.1.8, =0.0.10, =0.0.19 and more Source cves: CVE-2026-0994 Source advisory: SNYK:PYTHON-PROTOBUF-15090738...

neurocat (0.0.1), nevermined-metadata-driver-filecoin (>=0.1.0, <=0.2.1) +2 more potentially affected by CVE-2026-0994 via protobuf (3.15.1)

protobuf PYPI version 3.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - neurocat 0.0.1 - nevermined-metadata-driver-filecoin =0.1.0, =1.1.0, =1.2.2 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

nucypher (>=0.1.0a8, <=0.1.0a20) potentially affected by CVE-2026-0994 via protobuf (3.7.0rc2)

protobuf PYPI version 3.7.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - nucypher =0.1.0a8, =0.1.0a20 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

adsmsg (>=1.2.0, <=1.3.1), alphalogic-api3 (>=0.0.1, <=0.1.5) +62 more potentially affected by CVE-2026-0994 via protobuf (3.14.0)

protobuf PYPI version 3.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - adsmsg =1.2.0, =0.0.1, =0.1.0, =0.7.2b4, =0.0.1, =1.47.0, =0.0.1.dev50, =1.0.2, =0.4.8, =0.3.5, =2.0.3, =0.1.1, =0.9.1, =0.9.4 and more Source...

c7n-gcp (0.4.2), ciphey (3.5.7) +28 more potentially affected by CVE-2026-0994 via protobuf (3.12.2)

protobuf PYPI version 3.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - c7n-gcp 0.4.2 - ciphey 3.5.7 - custos-sdk 1.0.2 - dagit =0.8.6rc1, =0.8.6rc1, =0.8.6rc1, =0.2.24, =0.1.12, =0.0.0, =1.15.0b1, =0.3.0, =0.3.1,...

Uncontrolled Recursion

Overview protobuf is a Google’s data interchange format Affected versions of this package are vulnerable to Uncontrolled Recursion in the ParseDict function, when handling deeply nested google.protobuf.Any messages. An attacker can bypass maxrecursiondepth to exhaust the recursion stack and trigg...

abeja-sdk (>=2.2.0rc1, <=2.3.5rc1), accession (4.8.4) +352 more potentially affected by CVE-2026-0994 via protobuf (3.20.1)

protobuf PYPI version 3.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - abeja-sdk =2.2.0rc1, =0.8.3, =0.1.0, =0.0.0, =0.1.6, =0.10.0, =0.10.0, =3.5.4, =0.1.22, =7.0.2, =0.2.46, =0.2.56 and more Source cves:...

ac-solver (0.1.0), aioradio (>=0.20.23, <=0.21.1) +19 more potentially affected by CVE-2026-0994 via protobuf (4.25.4)

protobuf PYPI version 4.25.4 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - ac-solver 0.1.0 - aioradio =0.20.23, =1.0.0, =0.1.3, =0.3.3, =1.2.1, =3.2.0.9, =0.0.23, =0.1.5, =0.14.0, =0.1.0, =0.1.2 - rknn-toolkit2-compat...

cogdata (>=0.0.6, <=0.0.7), icetk (>=0.0.5, <=0.0.7) +3 more potentially affected by CVE-2026-0994 via protobuf (3.19.0rc2)

protobuf PYPI version 3.19.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - cogdata =0.0.6, =0.0.5, =3.0.0a2, =4.7.2 - motion-master-proto 5.2.0 - tensorflow-checkpoint-reader 0.1.2 Source cves: CVE-2026-0994 Source...

nucypher (6.0.0) potentially affected by CVE-2026-0994 via protobuf (3.20.0rc1)

protobuf PYPI version 3.20.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - nucypher 6.0.0 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

femtocrux (0.2.2), meteva (>=1.7.3, <=1.8.0.1) +3 more potentially affected by CVE-2026-0994 via protobuf (3.20.0rc2)

protobuf PYPI version 3.20.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - femtocrux 0.2.2 - meteva =1.7.3, =0.1.0, =0.0.2, =0.5.2, =1.0.0a8 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

ho-protocols (>=0.0.1, <=0.0.2.dev4), robotframework-browser (>=3.3.0, <=4.0.0) +1 more potentially affected by CVE-2026-0994 via protobuf (3.15.5)

protobuf PYPI version 3.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - ho-protocols =0.0.1, =3.3.0, =4.0.0 - sankee 0.0.1 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

alpha-data-py (>=1.0.0, <=1.0.9), beeper-hangups (>=0.5.0a1, <=0.5.0a5) +7 more potentially affected by CVE-2026-0994 via protobuf (3.16.0)

protobuf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - alpha-data-py =1.0.0, =0.5.0a1, =0.0.34, =0.20.5rc3, =0.2.0b1, =0.1.1.1, =4.4.0, =1.0.0, =1.0.1 Source cves: CVE-2026-0994 Source advisory:...

eqcctpro (>=0.3.0, <=0.6.1), ingestr (>=0.13.18, <=0.14.122) potentially affected by CVE-2026-0994 via protobuf (4.25.6)

protobuf PYPI version 4.25.6 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - eqcctpro =0.3.0, =0.13.18, =0.14.122 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

worldengine (0.18.0) potentially affected by CVE-2026-0994 via protobuf (2.6.0)

protobuf PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - worldengine 0.18.0 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

coinlib (>=1.0.6, <=1.0.7), wave-api (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-0994 via protobuf (3.15.3)

protobuf PYPI version 3.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - coinlib =1.0.6, =0.1.0, =0.1.2 Source cves: CVE-2026-0994 Source advisory: OSV:GHSA-7GCM-G887-7QV7...

c7n-gcp (>=0.4.18, <=0.4.19), c7n-mailer (0.6.18) +12 more potentially affected by CVE-2026-0994 via protobuf (4.21.7)

protobuf PYPI version 4.21.7 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - c7n-gcp =0.4.18, =2.7.0, =1.8.0rc1.dev1270, =0.3.1, =3.0.0, =1.0.0, =0.1.0, =0.1.1, =2.0.0.dev89, =0.0.1, =2.0.1 Source cves: CVE-2026-0994...

datasaku (0.0.8), dovesnap (>=1.1.11, <=1.1.12) +13 more potentially affected by CVE-2026-0994 via protobuf (4.23.0)

protobuf PYPI version 4.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - datasaku 0.0.8 - dovesnap =1.1.11, =0.105.0rc2, =0.10.0rc1, =2.2.12, =15.32.0, =3.25.0, =1.7.0, =3.0.0, =0.8.0rc1, =0.10.0rc1, =0.10.0 -...

adsmsg (>=1.3.3, <=1.3.19), algo-bus-sdk (>=0.0.1, <=0.0.9) +77 more potentially affected by CVE-2026-0994 via protobuf (3.17.3)

protobuf PYPI version 3.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - adsmsg =1.3.3, =0.0.1, =0.0.3, =0.4.9, =1.1.1, =2.1.1, =0.2.1, =0.4.11, =0.0.0rc24, =2.0.0, =1.3.0rc1, =1.3.0rc1.dev588, =0.0.12, =0.1.4 and mo...