CVE-2025-53605

Crash due to uncontrolled recursion in protobuf crate

5.9 MediumFix available

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.47%Up 0.4 points since Jul 5, 2025

What each source reports

CVE List Score used 5.9

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Record: CVE-2025-53605
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-674
Updated: 2026-11-02

EUVDEUVD-2025-20099 5.9

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Record: EUVD-2025-20099
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-2gh3-rmm4-6rq5 6.6

Crash due to uncontrolled recursion in protobuf crate

Affected version of this crate did not properly parse unknown fields when parsing a user-supplied input.

This allows an attacker to cause a stack overflow when parsing the message on untrusted data.

Record: GHSA-2gh3-rmm4-6rq5
CVSS 4.0: 6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Weakness: CWE-20, CWE-770
Updated: 2026-11-02

NVD 5.9

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Record: CVE-2025-53605
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-674
Updated: 2026-11-02

OSV 5.9

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Record: CVE-2025-53605
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-674
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-53605 5.9

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Record: DEBIAN-CVE-2025-53605
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 9 moreShow less

OSVGHSA-2gh3-rmm4-6rq5 6.6

Crash due to uncontrolled recursion in protobuf crate

Affected version of this crate did not properly parse unknown fields when parsing a user-supplied input.

This allows an attacker to cause a stack overflow when parsing the message on untrusted data.

Record: GHSA-2gh3-rmm4-6rq5
CVSS 4.0: 6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Weakness: CWE-20, CWE-770
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-53605 5.9

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Record: UBUNTU-CVE-2025-53605
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVAZL-65556 No score

CVE-2025-53605 affecting package kata-containers for versions less than 3.19.1.kata2-1

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Record: AZL-65556
Updated: 2026-11-02

OSVAZL-65565 No score

CVE-2025-53605 affecting package rust for versions less than 1.75.0-17

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Record: AZL-65565
Updated: 2026-11-05

OSVAZL-65568 No score

CVE-2025-53605 affecting package rust for versions less than 1.86.0-4

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Record: AZL-65568
Updated: 2026-11-05

OSVAZL-65574 No score

CVE-2025-53605 affecting package kata-containers 3.2.0.azl2-7

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Record: AZL-65574
Updated: 2026-11-02

OSVAZL-65577 No score

CVE-2025-53605 affecting package kata-containers-cc 3.2.0.azl2-8

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Record: AZL-65577
Updated: 2026-11-02

OSVAZL-65592 No score

CVE-2025-53605 affecting package rust for versions less than 1.72.0-11

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Record: AZL-65592
Updated: 2026-11-02

OSVRUSTSEC-2024-0437 No score

Crash due to uncontrolled recursion in protobuf crate

Affected version of this crate did not properly parse unknown fields when parsing a user-supplied input.

This allows an attacker to cause a stack overflow when parsing the mssage on untrusted data.

Record: RUSTSEC-2024-0437
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`protobuf` crates.io	before 3.7.2	3.7.2
`kata-containers` Azure Linux:3	before 3.19.1.kata2-1	3.19.1.kata2-1
`rust` Azure Linux:3	before 1.75.0-17	1.75.0-17
`rust` Azure Linux:3	1.85.0 up to 1.86.0-4	1.86.0-4
`kata-containers` Azure Linux:2	through 3.2.0.azl2-7	None known
`kata-containers-cc` Azure Linux:2	through 3.2.0.azl2-8	None known
`rust` Azure Linux:2	before 1.72.0-11	1.72.0-11
`rust-protobuf` Debian:12	All versions, plus listed versions 2.27.1-13.2.0-13.7.2-1	None known
`rust-protobuf` Debian:14	before 3.7.2-1, plus listed versions 2.25.2-12.27.1-12.8.1-12.8.1-23.2.0-1	3.7.2-1
`protobuf` crates.io	0.0.0-0 up to 3.7.2	3.7.2

Show 5 moreShow less

Affected packages
Package	Affected	Fixed
`rust-protobuf` Ubuntu:22.04:LTS	All versions, plus listed versions 2.8.1-22.25.2-1	None known
`rust-protobuf` Ubuntu:24.04:LTS	All versions, plus listed versions 2.27.1-1	None known
`rust-protobuf` Ubuntu:25.10	All versions, plus listed versions 2.27.1-1	None known
`rust-protobuf` Ubuntu:26.10	All versions, plus listed versions 3.7.2-1	None known
`rust-protobuf` Ubuntu:26.04:LTS	All versions, plus listed versions 2.27.1-12.27.1-1ubuntu13.7.2-1	None known

History

History
Recorded	Changed	Sources
Nov 5, 2026	facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-53605 is a medium vulnerability (CVSS 5.9) in Python Protobuf, published December 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in protobuf 3.7.2.

References

Show 6 moreShow less