PyPI/protobuf CVE-2026-0994: high 7.5, EPSS 0.71%
protobuf affected by a JSON recursion depth bypass
Action: Upgrade protobuf to 5.29.6 or later.
pip install protobuf==6.33.5pip install protobuf==5.29.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.30.0rc1 | 6.33.5 | - |
| 0 | 5.29.6 | - |
Fixed versions
| 6.33.5 | 5.29.6 |
Sources
- osv: GHSA-7gcm-g887-7qv7
- nvd: CVE-2026-0994
- https://github.com/protocolbuffers/protobuf/issues/25070
- https://github.com/protocolbuffers/protobuf/pull/25239
- https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf
- https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b
- https://github.com/protocolbuffers/protobuf
CVE-2026-0994 · published · modified · JSON