High-Severity DoS Flaw Hits Google Protocol Buffers (CVE-2026-0994)

A high-severity vulnerability (CVE-2026-0994) has been identified in Google Protocol Buffers' Python JSON parser (google.protobuf.json_format.ParseDict). An implementation flaw in handling nested google.protobuf.Any messages allows attackers to bypass max_recursion_depth checks, trigger unbounded recursion and exhaust Python's recursion stack, producing a RecursionError that can crash services (Denial-of-Service). The report recommends updating parsing logic to consistently enforce recursion limits or patching _ConvertAnyMessage() to correctly increment/decrement the recursion counter.