A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux | — |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| canonical | ubuntu linux | cert_advisory | 90% |
| red hat | enterprise linux | cert_advisory | 90% |
| resf | resf rocky linux | cert_advisory | 90% |
| su | suse opensuse | cert_advisory | 90% |
| su | suse linux | cert_advisory | 90% |
Updated vendor to Red Hat, product to Red Hat Enterprise Linux, changed severity to HIGH, and marked exploit as available and actively exploited.
Initial creation
