Security: Update protobuf when CVE-2026-0994 fix is released

[bjoernbethge]

Summary

CVE-2026-0994 affects protobuf versions ≤ 6.33.4. Currently on 6.33.4 (latest stable).

Vulnerability Details

• CVE: CVE-2026-0994
• Severity: High (CVSS 8.2)
• Type: Denial of Service (DoS) via uncontrolled recursion
• Affected: google.protobuf.json_format.ParseDict() with nested Any messages

Current Status

• ✅ Updated to protobuf 6.33.4 (latest stable)
• ⏳ Awaiting stable fix from upstream
• 🔄 Pre-release 7.34.0rc1 available but not compatible with all dependencies

Action Required

When protobuf releases a stable version with the fix:

uv lock --upgrade-package protobuf
uv sync

References

• GitHub Advisory GHSA-7gcm-g887-7qv7
• protobuf Issue #25070
• protobuf PR #25239
• protobuf Releases

Mitigation (current)

Until patched:

• Input validation on JSON payload depth before parsing
• Runtime safeguards limiting Python interpreter recursion depth