Google Protocol Buffers Denial-of-Service Vulnerability in JSON Parsing of Nested Any Messages

A denial-of-service vulnerability has been identified in the Google Protocol Buffers library for Python. The issue arises in the 'json_format.ParseDict()' function, where the maximum recursion depth limit can be circumvented when processing nested 'google.protobuf.Any' messages. This vulnerability is caused by inadequate recursion depth management in the internal logic that handles 'Any' types. An attacker can exploit this by providing deeply nested 'Any' structures that bypass the intended recursion limit, leading to a stack overflow and a 'RecursionError'.

Impact

Exploitation of this vulnerability causes a stack overflow, resulting in a 'RecursionError' and a denial-of-service condition.

Remediation

Users can update to the latest version of Google Protocol Buffers, where this vulnerability has been addressed, to mitigate this issue.