Red Hat Security AdvisoryRHSA-2026:3059
protobuf security update
Released 2026-02-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder EUS (v.9.4) protobuf-compiler-3.14.0-13.el9_4.1, protobuf-devel-3.14.0-13.el9_4.1, protobuf-lite-devel-3.14.0-13.el9_4.1
- Red Hat Enterprise Linux AppStream EUS (v.9.4) protobuf-3.14.0-13.el9_4.1, protobuf-lite-3.14.0-13.el9_4.1, python3-protobuf-3.14.0-13.el9_4.1
Fixes 1 record
Priority MEDIUM 43
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00712 · Published 2026-01-23 · Fixed in 6.33.5, 5.29.6 CWE-674
