Red Hat Security Advisory

RHSA-2026:3095

protobuf security update

Released 2026-02-23 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) protobuf-3.14.0-17.el9_7, protobuf-lite-3.14.0-17.el9_7, python3-protobuf-3.14.0-17.el9_7
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) protobuf-compiler-3.14.0-17.el9_7, protobuf-devel-3.14.0-17.el9_7, protobuf-lite-devel-3.14.0-17.el9_7

Fixes 1 record

TI-2026-00748 CVE-2026-0994 · GHSA-7gcm-g887-7qv7

Denial of Service in Python Protobuf

MEDIUM 43

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00712 Published 2026-01-23 Fixed in 6.33.5, 5.29.6 CWE-674