# Protobuf CVE-2026-0994

**URL:** <https://forum.pritunl.com/t/protobuf-cve-2026-0994/3710>\
**Category:** Pritunl\
**Created:** [February 9, 2026, 3:53am UTC](https://forum.pritunl.com/t/protobuf-cve-2026-0994/3710 "2026-02-09T03:53:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![defigor](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/d/ac8455/32.png) [@defigor](https://forum.pritunl.com/u/defigor)\
**Post date:** [February 9, 2026, 3:53am UTC](https://forum.pritunl.com/t/protobuf-cve-2026-0994/3710/1 "2026-02-09T03:53:45Z")

</div>

Hi,

Our security scanner alerted about CVE-2026-0994 ( [CVE-2026-0994 | Vulnerability Database | Aqua Security](https://avd.aquasec.com/nvd/2026/cve-2026-0994/) ) in protobuf in 1.32.4512.98 pritunl version.

Is there a plan to fix it?

Thanks,

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [February 9, 2026, 4:41pm UTC](https://forum.pritunl.com/t/protobuf-cve-2026-0994/3710/2 "2026-02-09T16:41:35Z")

</div>

There’s currently version conflicts due to the [**Oracle Cloud oci library**](https://github.com/oracle/oci-python-sdk/blob/master/requirements.txt) this is preventing `cryptography` from being upgraded and several other packages. It appears Oracle is not going to move past `cryptography` v46 so it’s going to require rewriting code to replace the oci library usage. I have already gone through the details and usage of these libraries in Pritunl and the vulnerable components in these libraries is not used in Pritunl.