CVE-2026-48712
protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · June 23, 2026
Updated · October 19, 2026
Description
A flaw was found in protobufjs. A remote attacker could exploit this by sending a crafted protobuf binary payload containing deeply nested 'Any' values. This uncontrolled recursion could exhaust the JavaScript call stack during conversion to JSON, leading to a Denial of Service (DoS).
Statement
Red Hat rates this issue as having Low impact for Red Hat Enterprise Linux AI bootc images. Although protobufjs is present as a transitive dependency, the vulnerable parsing path is not exercised in normal product operation.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No specific mitigation required for unaffected runtime paths.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-606 · Unchecked Input for Loop Condition