High [CVE-2026-59877] Denial of Service via crafted.proto schema
This high-severity Red Hat Linux advisory covers CVE-2026-59877 affecting Red Hat Enterprise Linux 10, Red Hat Ansible Automation Platform 2.1, Red Hat Ansible Automation Platform 2.2.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted.proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.
A remote attacker could exploit this vulnerability by providing a specially crafted.proto schema. This leads to a Denial of Service (DoS), making the affected system unresponsive.
The `protobufjs` library, used in Red Hat products, is susceptible to a Denial of Service when processing a specially crafted `.proto` schema. This is considered Important due to the potential for significant disruption to services that handle external protobuf definitions.
Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-835.
Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Ansible Automation Platform 2.1; Red Hat Ansible Automation Platform 2.2; Red Hat Developer Hub 1.10; and 13 more.
- < 7.6.5
- < 8.6.6
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
- 7.6.5
- 8.6.6
- rh-podman-desktop-0:1.1.2-1.el10_2
- ansible-automation-platform/automation-portal:1785854226
- ansible-automation-platform/automation-portal:1785857303
- ansible-automation-platform/bootc-automation-portal-rhel9:1786006573
- rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend:1785332487
- rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend:1785332825
- rhdh/rhdh-hub-rhel9:1785411652
- rhdh/rhdh-hub-rhel9:1785972843
- openshift4/ose-console-rhel9:1787158341
- openshift-service-mesh/kiali-ossmc-rhel9:1784824388
- openshift-service-mesh/kiali-rhel9:1784806326
- openshift-service-mesh/kiali-ossmc-rhel9:1784824894
- openshift-service-mesh/kiali-rhel9:1784806708
- RHSA-2026:57590
- RHSA-2026:50850
- RHSA-2026:50839
- RHSA-2026:51162
- RHSA-2026:48126
- RHSA-2026:49642
- RHSA-2026:52768
- RHSA-2026:57365
- RHSA-2026:49680
- RHSA-2026:49735
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Mitigation checklist
- Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update.
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.