CVE-2026-0994

ADVISORY - github

Summary

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

EPSS Score⁠: 0.00025 (0.066)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-674⁠

Uncontrolled Recursion

ADVISORY - github

CWE-674⁠

Uncontrolled Recursion

Impacted images

Advisories

NIST

CREATED

1 month ago

UPDATED

1 month ago

ADVISORY IDCVE-2026-0994⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-674⁠

CVSS SCORE

8.2high

GitHub

CREATED

1 month ago

UPDATED

26 days ago

ADVISORY IDGHSA-7gcm-g887-7qv7⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-674⁠

CVSS SCORE

8.2high

Alpine

CREATED

1 month ago

UPDATED

1 month ago

ADVISORY IDCVE-2026-0994⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Debian

CREATED

1 month ago

UPDATED

13 days ago

ADVISORY IDCVE-2026-0994⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Ubuntu

CREATED

1 month ago

UPDATED

6 days ago

ADVISORY IDCVE-2026-0994⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium

Alma

CREATED

9 days ago

UPDATED

8 days ago

ADVISORY IDALSA-2026:3095⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Amazon

CREATED

15 days ago

UPDATED

15 days ago

ADVISORY IDALAS2023-2026-1407⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Rocky

CREATED

7 days ago

UPDATED

7 days ago

ADVISORY IDRLSA-2026:3094⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Rocky

CREATED

7 days ago

UPDATED

7 days ago

ADVISORY IDRLSA-2026:3095⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Oracle

CREATED

9 days ago

UPDATED

9 days ago

ADVISORY IDELSA-2026-3094⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Oracle

CREATED

9 days ago

UPDATED

9 days ago

ADVISORY IDELSA-2026-3095⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Chainguard

CREATED

22 hours ago

UPDATED

22 hours ago

ADVISORY ID

CGA-jgjc-r94m-fgp2

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-chjg-5c76-pf73

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

1 month ago

UPDATED

1 month ago

ADVISORY ID

MINI-f9mc-r9fc-g3fx

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-ggq5-7v34-9phx

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-h4v9-6r3g-p4x2

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

1 month ago

UPDATED

1 month ago

ADVISORY ID

MINI-rv9c-v782-3mf2

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-vcvc-7f9g-7xj3

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY