Track protobuf 7.x upgrade for CVE-2026-0994 remediation

[jrmatherly]

Summary

Dependabot has identified CVE-2026-0994 (High severity) affecting protobuf <= 6.33.4 in two components:

• metrics-service/uv.lock (Alert Create Comprehensive docs/cognito.md Guide agentic-community/mcp-gateway-registry#29)
• agents/a2a/uv.lock (Alert Fix issue #27: Update README API documentation agentic-community/mcp-gateway-registry#28)

The fix is available in protobuf 7.34.0rc1, but we cannot upgrade due to upstream dependency constraints.

Vulnerability Details

CVE-2026-0994: JSON recursion depth bypass in google.protobuf.json_format.ParseDict()

• Type: Denial of Service (DoS)
• Vector: Nested google.protobuf.Any messages bypass max_recursion_depth limit
• Impact: Attackers can cause RecursionError by supplying deeply nested JSON
• Fix: PR #25239 merged Jan 23, 2026

Blocking Dependencies

Package	Current Version	Constraint	Upstream Repo
opentelemetry-proto	1.39.1	>=5.0,<7.0	opentelemetry-python
googleapis-common-protos	1.72.0	>=3.20.2,<7.0.0	python-api-common-protos
proto-plus	1.27.0	>=3.19.0,<7.0.0	proto-plus-python

All three packages explicitly require protobuf < 7.0.0, blocking our upgrade path.

Risk Assessment

Factor	Assessment
Direct protobuf usage	None - only transitive dependency
Affected services	Internal only (metrics-service, agents)
Attack vector	Requires crafted JSON with nested Any messages
Exploitability	Low - services don't parse untrusted protobuf JSON

Action Items

• Monitor upstream repos for protobuf 7.x compatibility releases
• Subscribe to relevant upstream issues/PRs:
  • opentelemetry-python protobuf 7.x support
  • googleapis protobuf 7.x support
• Upgrade when all blocking dependencies support protobuf 7.x
• Re-run uv lock for metrics-service and agents/a2a after upgrade
• Verify Dependabot alerts auto-close after upgrade

Upstream Tracking Links

• OpenTelemetry: Search opentelemetry-python issues
• Google APIs: Search python-api-common-protos issues
• Proto Plus: Search proto-plus-python issues

References

• CVE-2026-0994 NVD
• GitHub Issue #25070
• Fix PR #25239
• Dependabot Alert #28
• Dependabot Alert #29