High [CVE-2026-48712] Denial of Service via uncontrolled recursion with crafted protobuf payload

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON.

This affected generated toObject() conversion and the custom google.protobuf. Any JSON conversion path.

This vulnerability is fixed in 7.6.1 and 8.4.1. A flaw was found in protobufjs.

This uncontrolled recursion could exhaust the JavaScript call stack during conversion to JSON, leading to a Denial of Service (DoS). Red Hat rates this issue as having Low impact for Red Hat Enterprise Linux AI bootc images.

Although protobufjs is present as a transitive dependency, the vulnerable parsing path is not exercised in normal product operation. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-606. Affected Red Hat products: Red Hat Developer Hub 1.9; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4.

Red Hat lists Cryostat 4; OpenShift Pipelines; OpenShift Service Mesh 3; Red Hat Ansible Automation Platform 2; Red Hat Build of Podman Desktop; Red Hat Ceph Storage 9; Red Hat Enterprise Linux 8; Red Hat Hardened Images; Red Hat OpenShift Container Platform 4; Red Hat Openshift Data Foundation 4; Self-service automation portal 2 as not affected.