CVE-2026-54270

A flaw was found in protobufjs. This library compiles protobuf definitions into JavaScript (JS) functions. A remote attacker could send a specially crafted protobuf payload containing numerous unknown fields. This could cause the decoded message to retain substantially more memory than expected, leading to excessive memory consumption and potentially a Denial of Service (DoS) for applications processing untrusted protobuf data.

Red Hat rates this issue as having Low impact for Red Hat Enterprise Linux AI bootc images. Although protobufjs is present as a transitive dependency, the vulnerable parsing path is not exercised in normal product operation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No specific mitigation required for unaffected runtime paths.