PYSEC-2026-1806 protobuf-python has a potential Denial of Service issue

Summary Any project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. Reporter: Alexis Challande, Trail of Bits...

a2a-sdk (=0.2.8), a3t (>=0.0.0 <=0.0.1) +398 more potentially affected by CVE-2026-0994 via protobuf (>=6.30.1 <=6.33.4)

protobuf PYPI version =6.30.1, =0.0.0, =1.0.1, =0.1.3, =2025.12.2.2, =0.1.0, =0.4.0, =0.0.1, =0.1.17, =1.0.0, =1.0.29, =25.6.0b2, =0.1.0, =0.3.0, =0.9.1 and more Source cves: CVE-2026-0994 Source advisory: SNYK:PYTHON-PROTOBUF-15090738...

bsk (=2.8.33), bts-mlb (=0.1.2) +38 more potentially affected by CVE-2025-4565 via protobuf (>=6.30.1 <=6.31.0)

protobuf PYPI version =6.30.1, =1.0.0, =4.0.7, =0.2.0b3, =1.0.1, =1.0.0, =1.10.0, =0.0.0, =1.0.0, =1.1.0rc3 - isosegdenoise =0.1.2.dev310 and more Source cves: CVE-2025-4565 Source advisory: OSV:GHSA-8QVM-5X2C-J2W7...

OESA-2022-2012 protobuf security update

Security Fixes: A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can...

abeja-sdk (>=1.0.2 <=1.0.2rc1), acg-feature-extractor (=0.0.2) +270 more potentially affected by CVE-2021-22570 via protobuf (>=2.6.0 <=3.14.0rc3)

protobuf PYPI version =2.6.0, =1.0.2, =0.1.2, =1.1.2, =0.7.1, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =2.0.0, =2.0.1, =0.0.8, =0.0.1, =0.1.3, =1.3.0 and more Source cves: CVE-2021-22570 Source advisory: OSV:PYSEC-2022-48...