CVE-2025-4565 | THREATINT

Description

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901

Reserved 2025-05-12 | Published 2025-06-16 | Updated 2025-06-16 | Assigner Google

HIGH: 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-674 Uncontrolled Recursion

Product status

Default status

unaffected

Any version before 4.25.8

affected

Any version before 5.29.5

affected

Any version before 6.31.1

affected

Default status

unaffected

Any version before 4.25.8

affected

Any version before 5.29.5

affected

Any version before 6.31.1

affected

Credits

Alexis Challande - Trail of Bits Ecosystem Security Team finder

References

github.com/...ommit/17838beda2943d08b8a9d4df5b68f5f04f26d901

cve.org (CVE-2025-4565)

nvd.nist.gov (CVE-2025-4565)

Download JSON