Red Hat Security Advisory

RHSA-2026:3220

protobuf security update

Released 2026-02-24 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.2) protobuf-3.14.0-13.el9_2.1, protobuf-lite-3.14.0-13.el9_2.1, python3-protobuf-3.14.0-13.el9_2.1

Fixes 1 record

TI-2026-00748 CVE-2026-0994 · GHSA-7gcm-g887-7qv7

Denial of Service in Python Protobuf

MEDIUM 43

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00712 Published 2026-01-23 Fixed in 6.33.5, 5.29.6 CWE-674