SB2026042986 - SUSE update for protobuf

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Uncontrolled Recursion (CVE-ID: CVE-2025-4565)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

the vulnerability exists due to uncontrolled recursion when parsing untrusted data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags. A remote attacker send specially crafted input to the application and can perform a denial of service attack. 

2) Uncontrolled recursion (CVE-ID: CVE-2026-0994)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to uncontrolled recursion in within the google.protobuf.json_format.ParseDict(). A remote attacker can pass specially crafted input to the application and perform a denial of service attack. 

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2026/suse-su-20261653-1/