CVE-2026-59877: Denial of Service via crafted.proto schema

High [CVE-2026-59877] Denial of Service via crafted.proto schema

CVE-2026-59877Source published Jul 8, 2026Source updated Jul 8, 2026

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted.proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6. A remote attacker could exploit this vulnerability by providing a specially crafted.proto schema. This leads to a Denial of Service (DoS), making the affected system unresponsive. The `protobufjs` library, used in Red Hat products, is susceptible to a Denial of Service when processing a specially crafted `.proto` schema. This is considered Important due to the potential for…

Affected products in this advisory

• Cryostat 4 on RHEL 9
• Red Hat Enterprise Linux 10
• Red Hat Ansible Automation Platform 2.1
• Red Hat Ansible Automation Platform 2.2

15 more entries in the full advisory.

Source-reported affected versions

• < 7.6.5
• < 8.6.6

Source-reported fixed versions

• 7.6.5
• 8.6.6
• cryostat/cryostat-grafana-dashboard-rhel9:4.2.0-14
• rh-podman-desktop-0:1.1.2-1.el10_2

31 more entries in the full advisory.

Mitigation guidance

• Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update.

Critical [CVE-2025-61726 +30] Third-Party Package Updates in Splunk Enterprise - October 2026

SVD-2026-1009Source published Oct 21, 2026

This bulletin covers 31 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Splunk remedied common vulnerabilities and exposures (CVEs) in third-party packages in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher. Affected products named by the advisory: Splunk Enterprise 10.4; Splunk Enterprise 10.2; Splunk Enterprise 10.0; Splunk Enterprise 9.4.

Affected products in this advisory

• Splunk Enterprise 10.4
• Splunk Enterprise 10.2
• Splunk Enterprise 10.0
• Splunk Enterprise 9.4

Source-reported affected versions

• Splunk Enterprise 10.4.0 to 10.4.3
• Splunk Enterprise 10.2.0 to 10.2.7
• Splunk Enterprise 10.0.0 to 10.0.10
• Splunk Enterprise 9.4.0 to 9.4.15

Source-reported fixed versions

• Splunk Enterprise 10.4.4
• Splunk Enterprise 10.2.8
• Splunk Enterprise 10.0.11
• Splunk Enterprise 9.4.16

Mitigation guidance

• Upgrade Splunk Enterprise to versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher.