The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0618-1 advisory.

    i

    - CVE-2026-0994: Fixed google.protobuf.Any recursion depth bypass in Python json_format.ParseDict     (bsc#1257173).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by a vulnerability as referenced in the USN-8063-1 advisory.

    It was discovered that Protocol Buffers incorrectly handled recursion when the Python     google.protobuf.json_format.ParseDict() function is being used. An attacker could possibly use this issue     to cause Protocol Buffers to consume resources, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-235:01 advisory.

    * python: protobuf: Protobuf: Denial of Service due to recursion depth bypass (CVE-2026-0994)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3959 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file     unpacking (CVE-2026-24049)
    * automation-controller: pyasn1 has a DoS vulnerability in decoder (CVE-2026-23490)
    * automation-gateway: React Router vulnerable to XSS via Open Redirects (CVE-2026-22029)
    * python3.11-aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb     (CVE-2025-69223)
    * python3.11-django: Django: SQL injection via crafted column aliases in QuerySet.order_by()     (CVE-2026-1312)
    * python3.11-django: Django: SQL Injection via crafted column aliases (CVE-2026-1287)
    * python3.11-django: Django: Denial of Service via crafted HTML inputs (CVE-2026-1285)
    * python3.11-django: Django: SQL Injection via RasterField band index parameter (CVE-2026-1207)
    * python3.11-django: Django: Denial of Service via crafted request with duplicate headers (CVE-2025-14550)
    * python3.11-protobuf: Denial of Service in Python Protobuf (CVE-2026-0994)
    * receptor: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    * Python has been updated to 3.12 (AAP-56567)

    IMPORTANT: All users must download the latest version of the installer. Attempting to install or upgrade     with a previous version of the installer could result in failure.

    Automation Platform
    * The OpenAPI gateway spec is now accurate for the legacy_auth endpoint (AAP-63422)
    * Fixed a bug that was preventing users from viewing complete survey question choices that contained a     colon (AAP-66389)
    * Added source control branch option for inventory source form (AAP-63544)
    * automation-gateway has been updated to 2.5.20260225

    Automation controller
    * Added token auth to 2.5 (AAP-65488)
    * Fixed the job list endpoint to no longer load the job artifacts, resulting in better performance     (AAP-63221)
    * Enabled cross-organization credential sharing for teams. The changes were made in the legacy RBAC     functionality (AAP-54804)
    * automation-controller has been updated to 4.6.26

    Automation hub
    * Updated _ui/v2 endoints to properly enforce RBAC permissions (AAP-66638)
    * Added a static OpenAPI spec to galaxy that focuses the potential endpoints users can call (AAP-66417)
    * automation-hub has been updated to 4.10.12

    Event-Driven Ansible
    * Overrode RQ's default heartbeat to call register_birth, allowing worker re-registration in case of     worker disconnects from Redis, and also eliminating Ghost Workers. Also, bump rq version to 2.6.1, which     is a more recent and stable release (AAP-56872)
    * automation-eda-controller has been updated to 1.1.16

    Container-based Ansible Automation Platform
    * containerized installer setup has been updated to 2.5-22

    RPM-based Ansible Automation Platform
    * Fixed an issue where restore was not properly generating SSL certificate for redis in cluster mode     (AAP-60991)
    * ansible-automation-platform-installer and installer setup have been updated to 2.5-21

    Additional changes:
    * ansible-core has been updated to 2.16.16
    * All python3.11- prefixed rpms are replaced with python3.12- prefixed rpms

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the protobuf package has been released.

According to the versions of the protobuf packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where     the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.Due to     missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply     nested Any structures that bypass the intended recursion limit, eventually exhausting Python's recursion     stack and causing a RecursionError.(CVE-2026-0994)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization protobuf security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3094 advisory.

    The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can     encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and     automated mechanism for serializing structured data.

    Security Fix(es):

    * python: protobuf: Protobuf: Denial of Service due to recursion depth bypass (CVE-2026-0994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3097 advisory.

    The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can     encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and     automated mechanism for serializing structured data.

    Security Fix(es):

    * python: protobuf: Protobuf: Denial of Service due to recursion depth bypass (CVE-2026-0994)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-3094 advisory.

    - Fix CVE-2026-0994: nested Any messages bypassing recursion depth limits

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0093 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-0994:
    A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where     the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

    Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply     deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Pythons     recursion stack and causing a RecursionError.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the protobuf packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Any project that uses Protobuf Pure-Python backendto parse untrusted Protocol Buffers data containing an     arbitrary number of recursive groups, recursive messages or a series of SGROUPtags can be corrupted by     exceeding the Python recursion limit. This can result in a Denial of service by crashing the application     with a RecursionError. We recommend upgrading to version =6.31.1 or beyond     commit17838beda2943d08b8a9d4df5b68f5f04f26d901(CVE-2025-4565)

    A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where     the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.Due to     missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply     nested Any structures that bypass the intended recursion limit, eventually exhausting Python's recursion     stack and causing a RecursionError.(CVE-2026-0994)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization protobuf security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
300071	SUSE SLED15 / SLES15 Security Update : protobuf (SUSE-SU-2026:0618-1)	Nessus	SuSE Local Security Checks	2026/2/27	2026/2/27	high
300265	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : Protocol Buffers vulnerability (USN-8063-1)	Nessus	Ubuntu Local Security Checks	2026/3/2	2026/3/2	high
300494	MiracleLinux 9 : protobuf-3.14.0-17.el9_7 (AXSA:2026-235:01)	Nessus	Miracle Linux Local Security Checks	2026/3/4	2026/3/4	high
301388	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2026:3959)	Nessus	Red Hat Local Security Checks	2026/3/7	2026/3/7	high
310097	Photon OS 5.0: Protobuf PHSA-2026-5.0-0825	Nessus	PhotonOS Local Security Checks	2026/4/24	2026/4/24	high
319346	EulerOS Virtualization 2.13.1 : protobuf (EulerOS-SA-2026-2143)	Nessus	Huawei Local Security Checks	2026/6/6	2026/6/6	high
334478	Photon OS 5.0: Protobuf PHSA-2026-5.0-92-0949	Nessus	PhotonOS Local Security Checks	2026/8/11	2026/8/11	high
299815	RHEL 10 : protobuf (RHSA-2026:3094)	Nessus	Red Hat Local Security Checks	2026/2/23	2026/2/23	high
299818	RHEL 9 : protobuf (RHSA-2026:3097)	Nessus	Red Hat Local Security Checks	2026/2/23	2026/2/23	high
299821	Oracle Linux 10 : protobuf (ELSA-2026-3094)	Nessus	Oracle Linux Local Security Checks	2026/2/23	2026/2/23	high
300799	TencentOS Server 4: protobuf (TSSA-2026:0093)	Nessus	Tencent Local Security Checks	2026/3/5	2026/3/5	high
347219	EulerOS Virtualization 2.11.0 : protobuf (EulerOS-SA-2026-3541)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high