A vulnerability exists in the protobuf Python library’s json_format.ParseDict function, where the configured maximum recursion depth can be bypassed when parsing nested Any messages. This allows an attacker to supply deeply nested structures that evade the intended limit, causing the interpreter to exhaust its recursion stack and trigger a RecursionError. The result is a service interruption that affects the availability of any application using the vulnerable parsing routine.

The issue targets the Python protobuf implementation, specifically the google.protobuf.json_format module. Any deployment that relies on the protobuf library to parse JSON payloads containing Any messages may be affected. No specific version identifiers are provided, so all versions prior to the fix in the referenced pull request are potentially vulnerable.

With a CVSS score of 8.2 the vulnerability is considered high severity. The EPSS score is reported as less than 1%, indicating that while exploitation probability is low, the damage a successful attempt could cause is significant. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the flaw lies within the processing of user-supplied data, the likely attack vector is through application-level input, potentially from remote users sending crafted JSON. No additional exploit conditions are described in the available data.