Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-17T13:27:30 google-protobuf: google-protobuf: Denial of Service via uncontrolled recursion in protobuf group field parsing 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-606

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.

A flaw was found in google-protobuf. An unauthenticated remote attacker can send a specially crafted message containing deeply nested protobuf group fields to a Node.js service using the affected library. This uncontrolled recursion can cause the service to crash, leading to a Denial of Service (DoS) for legitimate users.

Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-core-bff-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-dashboard-operator-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-agent-ops-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-model-registry-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-89418 https://nvd.nist.gov/vuln/detail/CVE-2026-89418 https://github.com/protocolbuffers/protobuf-javascript/security/advisories/GHSA-5h29-r2cp-hfmr