https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:42:04 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:3094 <p><strong>Affected:</strong> AlmaLinux:10: protobuf, AlmaLinux:10: protobuf-compiler, AlmaLinux:10: protobuf-devel, AlmaLinux:10: protobuf-lite, AlmaLinux:10: protobuf-lite-devel, AlmaLinux:10: python3-protobuf</p> <p>The protobuf packages provide Protocol Buffers, Google&#39;s data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data.</p> <p>Security Fix(es):</p> <p>* python: protobuf: Protobuf: Denial of Service due to recursion depth bypass (CVE-2026-0994)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: protobuf, AlmaLinux:10: protobuf-compiler, AlmaLinux:10: protobuf-devel, AlmaLinux:10: protobuf-lite, AlmaLinux:10: protobuf-lite-devel, AlmaLinux:10: python3-protobuf</p> <p>The protobuf packages provide Protocol Buffers, Google&#39;s data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data.</p> <p>Security Fix(es):</p> <p>* python: protobuf: Protobuf: Denial of Service due to recursion depth bypass (CVE-2026-0994)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:3094 https://cve.radiocsirt.org/vuln/bdu:2026-05124 bdu:2026-05124 https://cve.radiocsirt.org/vuln/bdu:2026-05124 https://cve.radiocsirt.org/vuln/bell-cve-2026-0994 <p><strong>Affected:</strong> Alpaquita:stream: py3-protobuf</p> <p><strong>Affected:</strong> Alpaquita:stream: py3-protobuf</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-0994 https://cve.radiocsirt.org/vuln/brew-bilix-cve-2026-0994 <p><strong>Affected:</strong> Homebrew: bilix</p> <p>A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.</p> <p>Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.</p> <p><strong>Affected:</strong> Homebrew: bilix</p> <p>A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.</p> <p>Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.</p> https://cve.radiocsirt.org/vuln/brew-bilix-cve-2026-0994 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0218 certfr-2026-avi-0218 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0218 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 https://cve.radiocsirt.org/vuln/euvd-2026-362268 EUVD-2026-362268 https://cve.radiocsirt.org/vuln/euvd-2026-362268 https://cve.radiocsirt.org/vuln/fkie_cve-2026-0994 <p>A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.</p> <p>Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.</p> <p>A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.</p> <p>Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-0994 https://cve.radiocsirt.org/vuln/ghsa-7gcm-g887-7qv7 <p><strong>Affected:</strong> PyPI: protobuf</p> <p>A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.</p> <p>Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.</p> <p><strong>Affected:</strong> PyPI: protobuf</p> <p>A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.</p> <p>Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.</p> https://cve.radiocsirt.org/vuln/ghsa-7gcm-g887-7qv7 https://cve.radiocsirt.org/vuln/oesa-2026-1432 <p><strong>Affected:</strong> openEuler:24.03-LTS: protobuf, openEuler:24.03-LTS-SP1: protobuf, openEuler:24.03-LTS-SP2: protobuf, openEuler:24.03-LTS-SP3: protobuf, openEuler:20.03-LTS-SP4: protobuf, openEuler:22.03-LTS-SP4: protobuf</p> <p>Security Fix(es):</p> <p>A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.</p> <p>Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.(CVE-2026-0994)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: protobuf, openEuler:24.03-LTS-SP1: protobuf, openEuler:24.03-LTS-SP2: protobuf, openEuler:24.03-LTS-SP3: protobuf, openEuler:20.03-LTS-SP4: protobuf, openEuler:22.03-LTS-SP4: protobuf</p> <p>Security Fix(es):</p> <p>A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.</p> <p>Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.(CVE-2026-0994)</p> https://cve.radiocsirt.org/vuln/oesa-2026-1432 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10515-1 <p>libprotobuf-lite34_1_0-32bit-34.1-1.1 on GA media</p> <p>libprotobuf-lite34_1_0-32bit-34.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10515-1 https://cve.radiocsirt.org/vuln/pysec-2026-1805 <p><strong>Affected:</strong> PyPI: protobuf</p> <p>A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.</p> <p>Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.</p> <p><strong>Affected:</strong> PyPI: protobuf</p> <p>A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.</p> <p>Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1805 https://cve.radiocsirt.org/vuln/rhsa-2026:16174 <p>libxslt: Processing web content may disclose sensitive information libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service cpython: Excessive read buffering DoS in http.client gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification cpython: IMAP command injection in user-controlled commands cpython: POP3 command injection in user-controlled commands python: protobuf: Protobuf: Denial of Service due to recursion depth bypass cpython: email header injection due to unquoted newlines libvpx: Heap buffer overflow in libvpx openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing python: Python: Command-line option injection in webbrowser.open() via crafted URLs libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API giflib: Giflib: Double-free vulnerability leading to memory corruption…</p> <p>libxslt: Processing web content may disclose sensitive information libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service cpython: Excessive read buffering DoS in http.client gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification cpython: IMAP command injection in user-controlled commands cpython: POP3 command injection in user-controlled commands python: protobuf: Protobuf: Denial of Service due to recursion depth bypass cpython: email header injection due to unquoted newlines libvpx: Heap buffer overflow in libvpx openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing python: Python: Command-line option injection in webbrowser.open() via crafted URLs libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API giflib: Giflib: Double-free vulnerability leading to memory corruption…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:16174 https://cve.radiocsirt.org/vuln/suse-su-2026:0517-1 <p>Security update for protobuf</p> <p>Security update for protobuf</p> https://cve.radiocsirt.org/vuln/suse-su-2026:0517-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-0994 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: protobuf, Ubuntu:Pro:20.04:LTS: protobuf, Ubuntu:22.04:LTS: protobuf, Ubuntu:24.04:LTS: protobuf, Ubuntu:25.10: protobuf, Ubuntu:26.04:LTS: protobuf</p> <p>A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: protobuf, Ubuntu:Pro:20.04:LTS: protobuf, Ubuntu:22.04:LTS: protobuf, Ubuntu:24.04:LTS: protobuf, Ubuntu:25.10: protobuf, Ubuntu:26.04:LTS: protobuf</p> <p>A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-0994 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0480 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0480