https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-0994.htmlhttps://patchthecve.com/cve/CVE-2026-0994.htmlTue, 01 Sep 2026 13:18:07 +0000HIGH 7.5: A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker cahttps://patchthecve.com/cve/CVE-2024-7254.htmlhttps://patchthecve.com/cve/CVE-2024-7254.htmlWed, 17 Jun 2026 08:19:42 +0000HIGH 7.5: Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or agaihttps://patchthecve.com/cve/CVE-2024-2410.htmlhttps://patchthecve.com/cve/CVE-2024-2410.htmlWed, 17 Jun 2026 07:24:28 +0000HIGH 7.6: The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream. If the input is broken up into separate chunks in a certain way, the parser will attempt to read bytes from a chunk that has already been freed.  https://patchthecve.com/cve/CVE-2023-24535.htmlhttps://patchthecve.com/cve/CVE-2023-24535.htmlWed, 17 Jun 2026 05:39:29 +0000HIGH 7.5: Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.