PyPI/protobuf CVE-2026-0994: high 7.5, EPSS 0.71%
protobuf affected by a JSON recursion depth bypass
Action: Upgrade protobuf to 5.29.6 or later.
pip install protobuf==5.29.6pip install protobuf==6.33.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.29.6 | - |
| 6.30.0rc1 | 6.33.5 | - |
Fixed versions
| 5.29.6 | 6.33.5 |
Sources
- osv: PYSEC-2026-1805
- nvd: CVE-2026-0994
- https://github.com/protocolbuffers/protobuf/issues/25070
- https://github.com/protocolbuffers/protobuf/pull/25239
- https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf
- https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b
- https://github.com/protocolbuffers/protobuf
- https://pypi.org/project/protobuf
- https://github.com/advisories/GHSA-7gcm-g887-7qv7
CVE-2026-0994 · published · modified · JSON