A critical Denial of Service vulnerability (CVE-2026-0994, CVSS 8.2) affects Google's Python Protobuf library. A logic flaw in the `_ConvertAnyMessage` function allows attackers to bypass recursion limits using nested `google.protobuf.Any` messages. This enables a small JSON payload to trigger infinite recursion, crashing applications via stack exhaustion.

The issue stems from how the library parses 'Well-Known Types' nested inside `Any` messages. A proof-of-concept exploit is available, allowing network-based attacks against any Python application using `protobuf` for JSON transcoding. This particularly impacts gRPC services and data pipelines that accept untrusted JSON input, making them vulnerable to service disruption.

The fix, merged in PR-25239, corrects the recursion depth check in the parsing logic. Developers must immediately upgrade the `protobuf-python` library (versions >= 33.0 are vulnerable). Mitigation also includes validating JSON payload depth and configuring WAF rules. This vulnerability highlights the risks of complex serialization formats and the importance of rigorous input validation in widely-used developer tools.