THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-0994 (HIGH 7.5) — A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling l

[NVD] CVE-2026-0994 (HIGH 7.5) — A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling l

lownvdPublished 2026-01-23

CVE-2026-0994 CVSS: 7.5 HIGH Published: 2026-01-23T15:16:06.840

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structur

Indicators of compromise

CVE-2026-0994cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-0994