CVE-2026-0994: 
MySQL vulnerability analysis and mitigation

CVE-2026-0994 is a denial-of-service (DoS) vulnerability in the Python google.protobuf library, specifically in the google.protobuf.json_format.ParseDict() function, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. The vulnerability was reported on December 30, 2025, publicly disclosed on January 23, 2026, and affects protobuf (pip) versions >= 6.30.0rc1, <= 6.33.4 and < 5.29.6, as well as all versions up to and including 33.4 per NVD CPE data. Downstream products from IBM (API Connect, App Connect Enterprise, Cloud Pak for Automation, Maximo Application Suite, watsonx Orchestrate, and others) and Splunk Enterprise are also affected. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.2 (High) (Github Advisory, NVD).

The root cause is classified as CWE-674 (Uncontrolled Recursion). The json_format.ParseDict() function enforces a recursion depth limit via the max_recursion_depth parameter, implemented by incrementing a counter inside ConvertMessage(). However, the internal helper _ConvertAnyMessage() processes embedded google.protobuf.Any messages by calling itself recursively via methodcaller() for nested well-known types without incrementing or decrementing the recursion depth counter, effectively bypassing the configured limit entirely. An unauthenticated remote attacker can craft a JSON payload containing deeply nested Any structures (e.g., depth of 150,000 with max_recursion_depth=5) that bypasses the intended limit, exhausting Python's recursion stack and triggering a RecursionError instead of the expected ParseError. A public proof-of-concept was included in the original issue report, and the fix routes well-known type parsing through ConvertMessage() to ensure consistent depth accounting (GitHub Issue, GitHub PR).

Successful exploitation causes a RecursionError that crashes the Python process or disrupts service availability for any application that parses untrusted JSON input containing google.protobuf.Any messages. The impact is limited to availability — there is no confidentiality or integrity impact — but the crash can result in complete service unavailability for affected endpoints. Given the wide adoption of protobuf in cloud-native, AI/ML, and enterprise middleware stacks (including IBM Cloud Pak, Maximo, watsonx, Splunk Enterprise, and numerous open-source projects), the blast radius is significant for services that accept user-supplied JSON data (Github Advisory, Feedly).

1. Reconnaissance: Identify services that accept JSON input and use the Python google.protobuf library (versions < 5.29.6 or >= 6.30.0rc1, <= 6.33.4) to parse it — common in gRPC-based APIs, AI/ML inference endpoints, and cloud middleware.
2. Craft malicious payload: Construct a deeply nested JSON structure where each level wraps a google.protobuf.Any message inside another Any message, e.g.:

def make_nested_any(depth):
    root = {"@type": "type.googleapis.com/google.protobuf.Any", "value": {}}
    cur = root
    for _ in range(depth - 1):
        nxt = {"@type": "type.googleapis.com/google.protobuf.Any", "value": {}}
        cur["value"] = nxt
        cur = nxt
    return root
data = make_nested_any(150000)

3. Submit payload: Send the crafted JSON to the target service endpoint that calls json_format.ParseDict() on user-supplied input, e.g., via an HTTP POST request with Content-Type: application/json.
4. Trigger DoS: The _ConvertAnyMessage() function recurses without updating the depth counter, bypassing max_recursion_depth, until Python's recursion stack is exhausted and a RecursionError is raised, crashing the request handler or the entire process if the exception is unhandled (GitHub Issue).

• Network: Repeated HTTP requests containing deeply nested JSON payloads with @type: type.googleapis.com/google.protobuf.Any fields sent to protobuf-parsing endpoints; unusually large JSON request bodies targeting gRPC-JSON transcoding or REST API endpoints.
• Logs: Application logs showing RecursionError: maximum recursion depth exceeded originating from google/protobuf/json_format.py in the _ConvertAnyMessage or ConvertMessage call stack; sudden spike in 500-series HTTP errors or process crashes correlated with specific client IPs.
• Process: Python worker processes terminating unexpectedly or restarting in rapid succession; service monitoring alerts for increased error rates or availability degradation on endpoints that accept JSON protobuf input.

Upgrade the Python protobuf package to the patched versions: 5.29.6 or 6.33.5 (pip). The fix was merged via GitHub PR #25239 and routes Any message parsing through ConvertMessage() to enforce consistent recursion depth accounting. Google has confirmed that backporting to the end-of-life 4.x branch is not planned, though a 4.25.x backport was under consideration for compatibility reasons. As a workaround where upgrading is not immediately possible, implement application-level input validation to reject or limit JSON payload size and nesting depth before passing to ParseDict(), and apply rate limiting on endpoints that parse untrusted JSON. IBM and Splunk have issued separate advisories for their affected products and should be consulted for product-specific patch guidance (Github Advisory, GitHub PR, IBM Advisory, Splunk Advisory).

The vulnerability generated significant community frustration because the CVE was publicly disclosed before a patched release was available, leaving many projects exposed with no immediate fix. A protobuf team member acknowledged the process failure on GitHub, explaining that the internal CVE process moved unusually fast and was not gated on patch availability, and committed to tightening the release process going forward. Dozens of open-source projects temporarily disabled security scanning (e.g., Trivy) or added CVE exceptions to unblock CI/CD pipelines while awaiting the fix. The community also raised concerns about the lack of a 4.25.x backport, given widespread dependency conflicts with Google Cloud SDK libraries that pin to older protobuf versions. Security media outlets including SecurityOnline.info covered the vulnerability as a high-severity DoS flaw in Google Protocol Buffers (GitHub PR, SecurityOnline).