Recursion Stack Overflow in protobufjs Decoding before 7.5.6/8.0.2
CVE-2026-44289 Published on May 13, 2026

protobufjs: Denial of service through unbounded protobuf recursion
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

NVD

Vulnerability Analysis

CVE-2026-44289 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Types

What is a Stack Exhaustion Vulnerability?

The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

CVE-2026-44289 has been classified to as a Stack Exhaustion vulnerability or weakness.

Unchecked Input for Loop Condition

The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.


Products Associated with CVE-2026-44289

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Openshift Pipelines
 
Red Hat Ansible Automation Platform
 
Red Hat Podman Desktop
 
Red Hat Ceph Storage
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Enterprise Linux Ai
 
Red Hat Openshift
 
Red Hat Ansible Portal
 
Red Hat Service Mesh
 
Red Hat Rhdh
 
Red Hat Hummingbird
 
Red Hat Openshift Data Foundation
 

Affected Versions

protobufjs protobuf.js: Red Hat OpenShift Pipelines: Red Hat Ansible Automation Platform 2: Red Hat Build of Podman Desktop: Red Hat Ceph Storage 9: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat OpenShift Container Platform 4: Red Hat Self-service automation portal 2: Red Hat OpenShift Service Mesh 3: Red Hat Developer Hub: Red Hat Hardened Images: Red Hat Openshift Data Foundation 4:

Exploit Probability

EPSS
0.32%
Percentile
23.98%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.