CVE-2026-0994 Google CVE debrief

Who should care

Organizations using Google Protobuf in their applications should be aware of this vulnerability and take steps to mitigate it. Specifically, developers who use Google Protobuf in their Python applications should review their code to ensure that it is not vulnerable to this attack. Additionally, security teams should prioritize patching this vulnerability to prevent potential denial-of-service attacks.

Technical summary

The vulnerability exists in the google.protobuf.json_format.ParseDict() function in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. This is due to missing recursion depth accounting inside the internal Any-handling logic. An attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python's recursion stack and causing a RecursionError. The vulnerability has a CVSS score of 8.2 and is classified as a denial-of-service (DoS) vulnerability.

Defensive priority

High priority should be given to patching this vulnerability, as it can be exploited to cause a denial-of-service attack. Developers should review their code to ensure that it is not vulnerable to this attack, and security teams should prioritize patching this vulnerability.

Recommended defensive actions

• Apply the patch from https://github.com/protocolbuffers/protobuf/pull/25239
• Review and update Google Protobuf to a version that is not vulnerable
• Implement additional security measures to prevent denial-of-service attacks
• Monitor and track potential attacks exploiting this vulnerability
• Update inventory to reflect vulnerable and patched systems

Evidence notes

The vulnerability was published on January 23, 2026, and modified on June 30, 2026. The CVSS score is 8.2, indicating a high severity. The vulnerability affects Google Protobuf versions up to 33.4. There are multiple references and errata from Red Hat related to this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.