CVE-2025-53605 | THREATINT

Description

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Reserved 2025-07-05 | Published 2025-07-05 | Updated 2025-07-08 | Assigner mitre

MEDIUM: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem types

CWE-674 Uncontrolled Recursion

Product status

Default status

unaffected

Any version before 3.7.2

affected

References

github.com/stepancheg/rust-protobuf/issues/749

rustsec.org/advisories/RUSTSEC-2024-0437

crates.io/crates/protobuf

cve.org (CVE-2025-53605)

nvd.nist.gov (CVE-2025-53605)

Download JSON