Bug 2498127 (CVE-2026-59877) - CVE-2026-59877 protobufjs: protobufjs: Denial of Service via crafted .proto schema
Summary: CVE-2026-59877 protobufjs: protobufjs: Denial of Service via crafted .proto s...
Keywords:
Status: NEW
Alias: CVE-2026-59877
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2506042 2506043 2506044 2506045 2506046 2506047
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-08 16:02 UTC by OSIDB Bzimport
Modified: 2026-07-22 13:30 UTC (History)
49 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-08 16:02:17 UTC 
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.
Note You need to log in before you can comment on or make changes to this bug.