Uncontrolled Recursion in Protobuf Crate for Rust
CVE-2025-53605

5.9MEDIUM

Key Information:

Vendor

Stepancheg

Status
Protobuf
Vendor
CVE Published:
5 July 2025

What is CVE-2025-53605?

The Protobuf crate for Rust, prior to version 3.7.2, is susceptible to uncontrolled recursion when handling unknown fields during input parsing. This vulnerability can occur due to the improper handling of untrusted input, allowing for potential resource exhaustion and denial of service conditions. Developers utilizing this crate should upgrade to the latest version to mitigate this issue and ensure secure data handling.

Affected Version(s)

protobuf 0 < 3.7.2

References

https://github.com/stepancheg/rust-protobuf/issues/749
https://rustsec.org/advisories/RUSTSEC-2024-0437
https://crates.io/crates/protobuf

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.