CVE-2026-44290
Description
A flaw was found in protobufjs. This vulnerability allows an attacker to craft a protobuf schema or JSON descriptor that, when processed, can traverse through inherited object properties. This can lead to writing to global JavaScript constructors, corrupting process-wide built-in functionality. The most significant impact is a denial of service (DoS).
Statement
This is an Important denial of service vulnerability in protobufjs. A remote attacker could provide a specially crafted protobuf schema or JSON descriptor, which, when processed by an application using protobufjs, could corrupt process-wide built-in functionality, leading to a persistent denial of service. This impact is contingent on the application parsing untrusted schemas or descriptors.
Mitigation
To mitigate this issue, Red Hat recommends configuring applications to avoid parsing or loading protobuf schemas or JSON descriptors from untrusted sources. If processing untrusted schemas is unavoidable, implement strict validation to reject option names containing unsafe property path components before loading them. Additionally, consider running schema processing in an isolated environment to limit the blast radius of potential corruption.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
An attacker could modify sensitive data or program variables.
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Other,Integrity
Technical Impact: Varies by Context; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
