CLSA-2026-1787934757

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787934757.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1787934757
Upstream
CVE (2)
Published
2026-08-28T18:16:32Z
Modified
2026-10-26T09:32:03Z
Summary
Fix CVE(s): CVE-2024-7254, CVE-2026-0994
Details
  • SECURITY UPDATE: Unbounded recursion when parsing nested groups in protobuf-java
    • debian/patches/CVE-2024-7254.patch: bound the depth of the skipMessage()/skipField() recursion in CodedInputStream and of the nested-group recursion in UnknownFieldSetLite with the existing recursion limit, so a stream of nested SGROUP tags can no longer exhaust the Java stack
    • CVE-2024-7254
  • SECURITY UPDATE: Nested Any messages bypass the JSON parser recursion depth limit in python-protobuf
    • debian/patches/CVE-2026-0994.patch: add max_recursion_depth accounting to json_format and route nested well-known types in _ConvertAnyMessage() through ConvertMessage() so the depth is tracked
    • CVE-2026-0994
References

Affected packages

TuxCare:Ubuntu:18.04
libprotobuf-dev

Package

Name
libprotobuf-dev
Purl
pkg:deb/tuxcare/libprotobuf-dev?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.0-9.1ubuntu1.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787934757.json"
libprotobuf-java

Package

Name
libprotobuf-java
Purl
pkg:deb/tuxcare/libprotobuf-java?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.0-9.1ubuntu1.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787934757.json"
libprotobuf-lite10

Package

Name
libprotobuf-lite10
Purl
pkg:deb/tuxcare/libprotobuf-lite10?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.0-9.1ubuntu1.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787934757.json"
libprotobuf10

Package

Name
libprotobuf10
Purl
pkg:deb/tuxcare/libprotobuf10?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.0-9.1ubuntu1.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787934757.json"
libprotoc-dev

Package

Name
libprotoc-dev
Purl
pkg:deb/tuxcare/libprotoc-dev?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.0-9.1ubuntu1.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787934757.json"
libprotoc10

Package

Name
libprotoc10
Purl
pkg:deb/tuxcare/libprotoc10?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.0-9.1ubuntu1.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787934757.json"
protobuf-compiler

Package

Name
protobuf-compiler
Purl
pkg:deb/tuxcare/protobuf-compiler?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.0-9.1ubuntu1.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787934757.json"
python-protobuf

Package

Name
python-protobuf
Purl
pkg:deb/tuxcare/python-protobuf?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.0-9.1ubuntu1.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787934757.json"
python3-protobuf

Package

Name
python3-protobuf
Purl
pkg:deb/tuxcare/python3-protobuf?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.0-9.1ubuntu1.1+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787934757.json"