{"id":"CVE-2026-48712","title":"protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload (CVE-2026-48712)","summary":"A flaw was found in protobufjs. A remote attacker could exploit this by sending a crafted protobuf binary payload containing deeply nested 'Any' values. This uncontrolled recursion could exhaust the JavaScript call stack during conversion …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-606","CWE-674"],"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","affected":["enterprise_linux_ai_rhel_ai 3","developer_hub 1.9","openshift_ai 3.4"],"patched":["developer_hub 1.9","openshift_ai 3.4"],"published":"2026-06-22","updated":"2026-10-19","sourceUpdated":"2026-10-19T11:46:04+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48712.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48712.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-48712"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491451"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48712"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48712"},{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-wcpc-wj8m-hjx6"},{"url":"https://access.redhat.com/errata/RHSA-2026:52768"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"},{"url":"https://github.com/advisories/GHSA-wcpc-wj8m-hjx6"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.0046,"epssPercentile":0.39697,"aliases":["GHSA-wcpc-wj8m-hjx6"],"ecosystem":"npm","ingestedAt":"2026-07-07T15:41:58.736Z","slug":"CVE-2026-48712","body":"## Overview\n\nA flaw was found in protobufjs. A remote attacker could exploit this by sending a crafted protobuf binary payload containing deeply nested 'Any' values. This uncontrolled recursion could exhaust the JavaScript call stack during conversion to JSON, leading to a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **RHSA-2026:52768** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52768)\n- **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520)\n- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux AI (RHEL AI) 3 · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3 · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48712.json)\n\n**protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload** — rated Moderate by Red Hat. Released 2026-06-22, updated 2026-10-19.\n\nAffected:\n\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n\nFixed:\n\n- Red Hat Developer Hub 1.9\n- Red Hat OpenShift AI 3.4\n\nNo fix planned:\n\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n\nNot affected:\n\n- Red Hat Developer Hub 1.9\n- Red Hat OpenShift AI 3.4\n- Cryostat 4\n- OpenShift Pipelines\n- OpenShift Service Mesh 3\n- Red Hat Ansible Automation Platform 2\n- Red Hat Build of Podman Desktop\n- Red Hat Ceph Storage 9\n- Red Hat Enterprise Linux 8\n- Red Hat Hardened Images\n\n## Remediation\n\nFor more about Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:52768\nFor Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:60520\nFor Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:84734\n\nWorkarounds / mitigations:\n\n- No specific mitigation required for unaffected runtime paths.\n\n## Package advisory (CVE-2026-48712)\n\nAffected packages:\n\n- `protobufjs <= 7.6.0`\n- `protobufjs >= 8.0.0, <= 8.4.0`\n\nPatched in:\n\n- `protobufjs 7.6.1`\n- `protobufjs 8.4.1`\n\nSource: https://github.com/advisories/GHSA-wcpc-wj8m-hjx6","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}