CVE-2026-0994 Denial of Service in Python Protobuf

What is CVE-2026-0994?

CVE-2026-0994 is a high-severity denial of service vulnerability in Python Protobuf, published on 23 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

Weakness: CWE-674

Which versions are affected by CVE-2026-0994?

5 open source packages ship an affected version, including protobuf. It affects 1 product.

Products include Google Protobuf.

How do I fix CVE-2026-0994?

Upgrade protobuf to a fixed version for your release line: 5.29.6 or 6.33.5.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-0994 being exploited?

There is no known exploitation of CVE-2026-0994 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Python Protobuf

• CVE-2015-5237 Memory corruption in n/a High 8.8
• CVE-2024-7254 Stack overflow in Protocol Buffers Java Lite High 8.7
• CVE-2024-2410 Use after free in C++ protobuf High 7.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALSA-2026:3094, ALSA-2026:3095, AZL-75830, AZL-76481, AZL-76487, AZL-76505 and 46 more.