Aviral Garg d2b001626d Fix Any recursion depth bypass in Python json_format.ParseDict (#25239) ... This fixes a security vulnerability where nested google.protobuf.Any messages could bypass the max_recursion_depth limit, potentially leading to denial of service via stack overflow. The root cause was that _ConvertAnyMessage() was calling itself recursively via methodcaller() for nested well-known types, bypassing the recursion depth tracking in ConvertMessage(). The fix routes well-known type parsing through ConvertMessage() to ensure proper recursion depth accounting for all message types including nested Any. Fixes #25070 Closes #25239 COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/25239 from aviralgarg05:fix-any-recursion-depth-bypass 3cbbcbea142593d3afd2ceba2db14b05660f62f4 PiperOrigin-RevId: 862740421		2026-01-29 10:17:18 -08:00
..
protobuf	Fix Any recursion depth bypass in Python json_format.ParseDict (#25239)	2026-01-29 10:17:18 -08:00
__init__.py	drop-deprecated-pkg-resources-declare (#22442)	2025-07-11 11:09:55 -07:00