10 published AI models are associated with this package: 1 name it in a requirements or pyproject file, 5 load it or import it directly, and 4 are inferred from the runtime stack their declared library pulls in. Only 1 state a version requirement, so this is not a count of affected models.
cvss
7.5
high
CVSS v3.1 base score out of 10
epss
0.71%
medium
chance of exploitation in 30 days, 54th percentile of all CVEs
xyz score
4.9
medium
CyberXYZ composite out of 10
fig. 01 — GHSA-7gcm-g887-7qv7, the advisory selected below
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.
Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
// cvss v3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Checked 2026-11-06 at 22:48 UTC. The most recent advisory here was published 2026-01-23. Updated continuously from NVD, GHSA, OSV and CNA feeds.