{"id":"CVE-2025-4565","aliases":["AZL-64116","AZL-64145","CLSA-2025-1762301642","DEBIAN-CVE-2025-4565","EUVD-2025-18401","GHSA-8qvm-5x2c-j2w7","OESA-2025-1713","OESA-2025-1714","OESA-2025-1798","OESA-2025-1799","OESA-2025-1800","OESA-2025-1801","PYSEC-2026-1806","RHSA-2026:1249","ROOT-APP-PYPI-CVE-2025-4565","SUSE-SU-2025:02309-1","SUSE-SU-2025:02310-1","SUSE-SU-2025:02311-1","SUSE-SU-2025:20514-1","SUSE-SU-2025:20672-1","SUSE-SU-2025:3722-1","SUSE-SU-2026:1653-1","SUSE-SU-2026:20753-1","SUSE-SU-2026:20907-1","UBUNTU-CVE-2025-4565","USN-7629-1","USN-7629-2","openSUSE-SU-2025:15265-1","openSUSE-SU-2026:20390-1"],"status":"published","title":"Unbounded recursion in Python Protobuf","description":"Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u003e6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00255,"percentile":0.17209,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2025-06-16T14:50:40Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"PyPI","package":"protobuf","fixed_in":["4.25.8","5.29.5","6.31.1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"protobuf","fixed_in":["3.17.3-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"protobuf","fixed_in":["25.3-5"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"protobuf","fixed_in":["4.24.3.post1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"protobuf","fixed_in":["3.21.12-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"protobuf","fixed_in":["3.21.12-11+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"protobuf","fixed_in":["3.21.12-12"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"protobuf","fixed_in":["3.14.0-9.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"protobuf","fixed_in":["3.14.0-9.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"protobuf","fixed_in":["25.1-9.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"protobuf","fixed_in":["25.1-11.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"protobuf","fixed_in":["3.14.0-8.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"protobuf","fixed_in":["25.1-9.oe2403"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"protobuf","fixed_in":["4.25.4+aikido.2","4.24.1+aikido.3","5.29.4+aikido.2","4.25.3+aikido.2","4.25.5+aikido.3","4.24.4+aikido.2","4.25.7+aikido.2","5.29.4+aikido.9","4.25.5+aikido.11","3.20.0+aikido.4","4.25.3+aikido.3","4.25.7+aikido.3","4.25.4+aikido.3","4.24.1+aikido.4","4.24.4+aikido.3","4.24.4+aikido.4","4.25.4+aikido.4","4.25.3+aikido.4","3.20.0+aikido.5","4.24.1+aikido.5","4.25.5+aikido.12","4.25.7+aikido.4","5.29.4+aikido.10"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"protobuf","fixed_in":["25.1-150400.9.16.1","3.9.2-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"protobuf","fixed_in":["25.1-150400.9.16.1","3.9.2-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"protobuf","fixed_in":["25.1-150400.9.16.1","3.9.2-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"protobuf","fixed_in":["25.1-150400.9.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"protobuf","fixed_in":["25.1-150500.12.11.1","3.9.2-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"protobuf","fixed_in":["25.1-150500.12.11.1","3.9.2-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"protobuf","fixed_in":["25.1-150600.16.13.1","3.9.2-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"protobuf","fixed_in":["25.1-150600.16.13.1","3.9.2-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"protobuf","fixed_in":["25.1-150600.16.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"protobuf","fixed_in":["25.1-150600.16.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"protobuf","fixed_in":["25.1-150600.16.13.1","3.9.2-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"protobuf","fixed_in":["25.1-150600.16.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"protobuf","fixed_in":["25.1-150600.16.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"protobuf","fixed_in":["25.1-150600.16.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"protobuf","fixed_in":["23.4-10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"protobuf","fixed_in":["3.9.2-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"protobuf","fixed_in":["3.9.2-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"protobuf","fixed_in":["3.9.2-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"protobuf","fixed_in":["3.9.2-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"protobuf","fixed_in":["3.9.2-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"protobuf","fixed_in":["3.9.2-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"protobuf","fixed_in":["2.6.1-1.3ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"protobuf","fixed_in":["3.0.0-9.1ubuntu1.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"protobuf","fixed_in":["3.6.1.3-2ubuntu5.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"protobuf","fixed_in":["3.12.4-1ubuntu7.22.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"protobuf","fixed_in":["3.21.12-8.2ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"protobuf","fixed_in":["31.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.25.8"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.26.0rc1"},{"fixed":"5.29.5"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.30.0rc1"},{"fixed":"6.31.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.3-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-5"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.24.3"},{"fixed":"4.24.3.post1+tuxcare"}]}],"versions":["4.24.3"]},{"source":"osv","ecosystem":"Debian:12","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.12-3+deb12u1"}]}],"versions":["3.21.12-3"]},{"source":"osv","ecosystem":"Debian:13","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.12-11+deb13u1"}]}],"versions":["3.21.12-11"]},{"source":"osv","ecosystem":"Debian:14","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.12-12"}]}],"versions":["3.21.12-11"]},{"source":"osv","ecosystem":"PyPI","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.25.8"}]}],"versions":["2.0.0beta","2.0.3","2.3.0","2.4.1","2.5.0","2.6.0","2.6.1","3.0.0","3.0.0a2","3.0.0a3","3.0.0b1","3.0.0b1.post1","3.0.0b1.post2","3.0.0b2","3.0.0b2.post1","3.0.0b2.post2","3.0.0b3","3.0.0b4","3.1.0","3.1.0.post1","3.10.0","3.10.0rc1","3.11.0","3.11.0rc1","3.11.0rc2","3.11.1","3.11.2","3.11.3","3.12.0","3.12.0rc1","3.12.0rc2","3.12.1","3.12.2","3.12.4","3.13.0","3.13.0rc3","3.14.0","3.14.0rc1","3.14.0rc2","3.14.0rc3","3.15.0","3.15.0rc1","3.15.0rc2","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.16.0","3.16.0rc1","3.16.0rc2","3.17.0","3.17.0rc1","3.17.0rc2","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0rc1","3.18.0rc2","3.18.1","3.18.3","3.19.0","3.19.0rc1","3.19.0rc2","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5","3.19.6","3.2.0","3.2.0rc1","3.2.0rc1.post1","3.2.0rc2","3.20.0","3.20.0rc1","3.20.0rc2","3.20.1","3.20.1rc1","3.20.2","3.20.3","3.3.0","3.4.0","3.5.0.post1","3.5.1","3.5.2","3.5.2.post1","3.6.0","3.6.1","3.7.0","3.7.0rc2","3.7.0rc3","3.7.1","3.8.0","3.8.0rc1","3.9.0","3.9.0rc1","3.9.1","3.9.2","4.0.0rc1","4.0.0rc2","4.21.0","4.21.0rc1","4.21.0rc2","4.21.1","4.21.10","4.21.11","4.21.12","4.21.2","4.21.3","4.21.4","4.21.5","4.21.6","4.21.7","4.21.8","4.21.9","4.22.0","4.22.0rc1","4.22.0rc2","4.22.0rc3","4.22.1","4.22.3","4.22.4","4.22.5","4.23.0","4.23.0rc2","4.23.0rc3","4.23.1","4.23.2","4.23.3","4.23.4","4.24.0","4.24.0rc1","4.24.0rc2","4.24.0rc3","4.24.1","4.24.2","4.24.3","4.24.4","4.25.0","4.25.0rc1","4.25.0rc2","4.25.1","4.25.2","4.25.3","4.25.4","4.25.5","4.25.6","4.25.7"]},{"source":"osv","ecosystem":"PyPI","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.26.0rc1"},{"fixed":"5.29.5"}]}],"versions":["5.26.0","5.26.0rc1","5.26.0rc2","5.26.0rc3","5.26.1","5.27.0","5.27.0rc1","5.27.0rc2","5.27.0rc3","5.27.1","5.27.2","5.27.3","5.27.4","5.27.5","5.28.0","5.28.0rc1","5.28.0rc2","5.28.0rc3","5.28.1","5.28.2","5.28.3","5.29.0","5.29.0rc1","5.29.0rc2","5.29.0rc3","5.29.1","5.29.2","5.29.3","5.29.4"]},{"source":"osv","ecosystem":"PyPI","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.30.0rc1"},{"fixed":"6.31.1"}]}],"versions":["6.30.0","6.30.0rc1","6.30.0rc2","6.30.1","6.30.2","6.31.0","6.31.0rc1","6.31.0rc2"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0-9.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0-9.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-9.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-11.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0-8.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-9.oe2403"}]}]},{"source":"osv","ecosystem":"PyPI","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.25.8"},{"introduced":"5.26.0rc1"},{"fixed":"5.29.5"},{"introduced":"6.30.0rc1"},{"fixed":"6.31.1"}]}],"versions":["2.0.0beta","2.0.3","2.3.0","2.4.1","2.5.0","2.6.0","2.6.1","3.0.0","3.0.0a2","3.0.0a3","3.0.0b1","3.0.0b1.post1","3.0.0b1.post2","3.0.0b2","3.0.0b2.post1","3.0.0b2.post2","3.0.0b3","3.0.0b4","3.1.0","3.1.0.post1","3.10.0","3.10.0rc1","3.11.0","3.11.0rc1","3.11.0rc2","3.11.1","3.11.2","3.11.3","3.12.0","3.12.0rc1","3.12.0rc2","3.12.1","3.12.2","3.12.4","3.13.0","3.13.0rc3","3.14.0","3.14.0rc1","3.14.0rc2","3.14.0rc3","3.15.0","3.15.0rc1","3.15.0rc2","3.15.1","3.15.2","3.15.3","3.15.4","3.15.5","3.15.6","3.15.7","3.15.8","3.16.0","3.16.0rc1","3.16.0rc2","3.17.0","3.17.0rc1","3.17.0rc2","3.17.1","3.17.2","3.17.3","3.18.0","3.18.0rc1","3.18.0rc2","3.18.1","3.18.3","3.19.0","3.19.0rc1","3.19.0rc2","3.19.1","3.19.2","3.19.3","3.19.4","3.19.5","3.19.6","3.2.0","3.2.0rc1","3.2.0rc1.post1","3.2.0rc2","3.20.0","3.20.0rc1","3.20.0rc2","3.20.1","3.20.1rc1","3.20.2","3.20.3","3.3.0","3.4.0","3.5.0.post1","3.5.1","3.5.2","3.5.2.post1","3.6.0","3.6.1","3.7.0","3.7.0rc2","3.7.0rc3","3.7.1","3.8.0","3.8.0rc1","3.9.0","3.9.0rc1","3.9.1","3.9.2","4.0.0rc1","4.0.0rc2","4.21.0","4.21.0rc1","4.21.0rc2","4.21.1","4.21.10","4.21.11","4.21.12","4.21.2","4.21.3","4.21.4","4.21.5","4.21.6","4.21.7","4.21.8","4.21.9","4.22.0","4.22.0rc1","4.22.0rc2","4.22.0rc3","4.22.1","4.22.3","4.22.4","4.22.5","4.23.0","4.23.0rc2","4.23.0rc3","4.23.1","4.23.2","4.23.3","4.23.4","4.24.0","4.24.0rc1","4.24.0rc2","4.24.0rc3","4.24.1","4.24.2","4.24.3","4.24.4","4.25.0","4.25.0rc1","4.25.0rc2","4.25.1","4.25.2","4.25.3","4.25.4","4.25.5","4.25.6","4.25.7","5.26.0","5.26.0rc1","5.26.0rc2","5.26.0rc3","5.26.1","5.27.0","5.27.0rc1","5.27.0rc2","5.27.0rc3","5.27.1","5.27.2","5.27.3","5.27.4","5.27.5","5.28.0","5.28.0rc1","5.28.0rc2","5.28.0rc3","5.28.1","5.28.2","5.28.3","5.29.0","5.29.0rc1","5.29.0rc2","5.29.0rc3","5.29.1","5.29.2","5.29.3","5.29.4","6.30.0","6.30.0rc1","6.30.0rc2","6.30.1","6.30.2","6.31.0","6.31.0rc1","6.31.0rc2"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.11-protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.25.8-1.el9ap"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.11-protobuf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.25.8-1.el9ap"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.11-protobuf-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.25.8-1.el9ap"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.8-1.el9ap"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-2.el10ap"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-2.el9ap"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-2.el9ap"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-2.el9ap"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.27-2.el9ap"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.27-2.el9ap"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.11-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.3-1.el9ap"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.11-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.3-1.el9ap"}]}],"bundled":6},{"source":"osv","ecosystem":"Root:PyPI","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.25.4+aikido.2"},{"fixed":"4.24.1+aikido.3"},{"fixed":"5.29.4+aikido.2"},{"fixed":"4.25.3+aikido.2"},{"fixed":"4.25.5+aikido.3"},{"fixed":"4.24.4+aikido.2"},{"fixed":"4.25.7+aikido.2"},{"fixed":"5.29.4+aikido.9"},{"fixed":"4.25.5+aikido.11"},{"fixed":"3.20.0+aikido.4"},{"fixed":"4.25.3+aikido.3"},{"fixed":"4.25.7+aikido.3"},{"fixed":"4.25.4+aikido.3"},{"fixed":"4.24.1+aikido.4"},{"fixed":"4.24.4+aikido.3"},{"fixed":"4.24.4+aikido.4"},{"fixed":"4.25.4+aikido.4"},{"fixed":"4.25.3+aikido.4"},{"fixed":"3.20.0+aikido.5"},{"fixed":"4.24.1+aikido.5"},{"fixed":"4.25.5+aikido.12"},{"fixed":"4.25.7+aikido.4"},{"fixed":"5.29.4+aikido.10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-150400.9.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-150400.9.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-150400.9.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-150400.9.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-150500.12.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-150500.12.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-150600.16.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-150600.16.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-150600.16.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-150600.16.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-150600.16.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-150600.16.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-150600.16.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1-150600.16.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.4-10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.4-slfo.1.1_2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.3-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.3-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1-3ubuntu2","2.4.1-3ubuntu3","2.4.1-3ubuntu4","2.5.0-5ubuntu2","2.5.0-7ubuntu1","2.5.0-8ubuntu1","2.5.0-9ubuntu1","2.5.0-9ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-1.3ubuntu0.1~esm4"}]}],"versions":["2.6.1-1.2","2.6.1-1.3","2.6.1-1.3ubuntu0.1~esm1","2.6.1-1.3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-9.1ubuntu1.1+esm3"}]}],"versions":["3.0.0-9ubuntu5","3.0.0-9ubuntu6","3.0.0-9.1ubuntu1","3.0.0-9.1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1.3-2ubuntu5.2+esm2"}]}],"versions":["3.6.1.3-2","3.6.1.3-2ubuntu1","3.6.1.3-2ubuntu3","3.6.1.3-2ubuntu4","3.6.1.3-2ubuntu5","3.6.1.3-2ubuntu5.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.4-1ubuntu7.22.04.4"}]}],"versions":["3.12.4-1ubuntu3","3.12.4-1ubuntu5","3.12.4-1ubuntu6","3.12.4-1ubuntu7","3.12.4-1ubuntu7.22.04.1","3.12.4-1ubuntu7.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.12-8.2ubuntu0.2"}]}],"versions":["3.21.12-7ubuntu1","3.21.12-8ubuntu1","3.21.12-8ubuntu5","3.21.12-8.2","3.21.12-8.2build1","3.21.12-8.2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.4-1ubuntu7.22.04.4"}]}],"versions":["3.12.4-1ubuntu3","3.12.4-1ubuntu5","3.12.4-1ubuntu6","3.12.4-1ubuntu7","3.12.4-1ubuntu7.22.04.1","3.12.4-1ubuntu7.22.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.12-8.2ubuntu0.2"}]}],"versions":["3.21.12-7ubuntu1","3.21.12-8ubuntu1","3.21.12-8ubuntu5","3.21.12-8.2","3.21.12-8.2build1","3.21.12-8.2ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-1.3ubuntu0.1~esm4"}]}],"versions":["2.6.1-1.2","2.6.1-1.3","2.6.1-1.3ubuntu0.1~esm1","2.6.1-1.3ubuntu0.1~esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-9.1ubuntu1.1+esm3"}]}],"versions":["3.0.0-9ubuntu5","3.0.0-9ubuntu6","3.0.0-9.1ubuntu1","3.0.0-9.1ubuntu1.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1.3-2ubuntu5.2+esm2"}]}],"versions":["3.6.1.3-2","3.6.1.3-2ubuntu1","3.6.1.3-2ubuntu3","3.6.1.3-2ubuntu4","3.6.1.3-2ubuntu5","3.6.1.3-2ubuntu5.2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"protobuf-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.3-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"google","product":"protobuf-python"},{"vendor":"protocolbuffers","product":"python-protobuf"}],"references":[{"url":"https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901","tags":["Patch","fix","web","article"]},{"url":"https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8","tags":["web"]},{"url":"https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8qvm-5x2c-j2w7","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4565","tags":["web","advisory"]},{"url":"https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/decoder_test.py#L87-L98","tags":["web"]},{"url":"https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/message_test.py#L1436-L1478","tags":["web"]},{"url":"https://github.com/protocolbuffers/protobuf/tree/main/python#implementation-backends","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8qvm-5x2c-j2w7","tags":["advisory"]},{"url":"https://github.com/protocolbuffers/protobuf/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4565.json","tags":["advisory"]},{"url":"https://pypi.org/project/protobuf/","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-4565","tags":["advisory"]},{"url":"https://github.com/protocolbuffers/protobuf","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1713","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1714","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1798","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1799","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1800","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1801","tags":["advisory"]},{"url":"https://pypi.org/project/protobuf","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1249","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/html/release_notes/patch_releases","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2380000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418462","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2419467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2427456","tags":["report"]},{"url":"https://issues.redhat.com/browse/AAP-60364","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1249.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-4565","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-4565","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-53643","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-53643","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53643","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61729","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61729","tags":["advisory"]},{"url":"https://go.dev/cl/725920","tags":["article"]},{"url":"https://go.dev/issue/76445","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/8FJoBkPddm4","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4155","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-64460","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-64460","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64460","tags":["advisory"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["article"]},{"url":"https://groups.google.com/g/django-announce","tags":["article"]},{"url":"https://www.djangoproject.com/weblog/2025/dec/02/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-66471","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66471","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66471","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7","tags":["article"]},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69223","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69223","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69223","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502309-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1244663","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4565","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502310-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502311-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520514-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520672-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223947","tags":["report"]},{"url":"https://bugzilla.suse.com/1230778","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7254","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253722-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261653-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257173","tags":["report"]},{"url":"https://bugzilla.suse.com/1260019","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0994","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620753-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1244918","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620907-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-4565","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7629-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7629-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-7254","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-4565","title":"Unbounded recursion in Python Protobuf","description":"Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u003e6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901","status":"published","published":"2025-06-16T14:50:40.906Z","modified":"2025-06-16T15:39:18.263Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:32:48.512547Z"}],"euvd":[{"id":"EUVD-2025-18401","description":"Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u003e6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901","status":"published","published":"2025-06-16T14:50:40Z","modified":"2025-06-16T15:39:18Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T20:32:23.637399Z"}],"ghsa":[{"id":"GHSA-8qvm-5x2c-j2w7","title":"protobuf-python has a potential Denial of Service issue","description":"### Summary\nAny project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of **recursive groups**, **recursive messages** or **a series of [`SGROUP`](https://protobuf.dev/programming-guides/encoding/#groups) tags** can be corrupted by exceeding the Python recursion limit.\n\nReporter: Alexis Challande, Trail of Bits Ecosystem Security Team\n[ecosystem@trailofbits.com](mailto:ecosystem@trailofbits.com)\n\nAffected versions: This issue only affects the [pure-Python implementation](https://github.com/protocolbuffers/protobuf/tree/main/python#implementation-backends) of protobuf-python backend. This is the implementation when `PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python` environment variable is set or the default when protobuf is used from Bazel or pure-Python PyPi wheels. CPython PyPi wheels do not use pure-Python by default.\n\nThis is a Python variant of a [previous issue affecting protobuf-java](https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8).\n\n### Severity\nThis is a potential Denial of Service. Parsing nested protobuf data creates unbounded recursions that can be abused by an attacker.\n\n### Proof of Concept\nFor reproduction details, please refer to the unit tests [decoder_test.py](https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/decoder_test.py#L87-L98) and [message_test](https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/message_test.py#L1436-L1478)\n\n### Remediation and Mitigation\nA mitigation is available now. Please update to the latest available versions of the following packages:\n* protobuf-python(4.25.8, 5.29.5, 6.31.1)","status":"published","published":"2025-06-16T16:02:58Z","modified":"2025-06-16T16:03:02Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:38:47.835488Z"}],"nvd":[{"id":"CVE-2025-4565","description":"Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u003e6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901","status":"published","published":"2025-06-16T15:15:24.99Z","modified":"2026-06-17T09:33:31.963Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:11:13.247441Z"}],"osv":[{"id":"CVE-2025-4565","title":"Unbounded recursion in Python Protobuf","description":"Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u003e6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901","status":"published","published":"2025-06-16T14:50:40.906Z","modified":"2026-10-28T11:01:42.752814009Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"DEBIAN-CVE-2025-4565","description":"Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u003e6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901","status":"published","published":"2025-06-16T15:15:24.99Z","modified":"2026-09-01T20:05:52.639550604Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-8qvm-5x2c-j2w7","title":"protobuf-python has a potential Denial of Service issue","description":"### Summary\nAny project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of **recursive groups**, **recursive messages** or **a series of [`SGROUP`](https://protobuf.dev/programming-guides/encoding/#groups) tags** can be corrupted by exceeding the Python recursion limit.\n\nReporter: Alexis Challande, Trail of Bits Ecosystem Security Team\n[ecosystem@trailofbits.com](mailto:ecosystem@trailofbits.com)\n\nAffected versions: This issue only affects the [pure-Python implementation](https://github.com/protocolbuffers/protobuf/tree/main/python#implementation-backends) of protobuf-python backend. This is the implementation when `PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python` environment variable is set or the default when protobuf is used from Bazel or pure-Python PyPi wheels. CPython PyPi wheels do not use pure-Python by default.\n\nThis is a Python variant of a [previous issue affecting protobuf-java](https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8).\n\n### Severity\nThis is a potential Denial of Service. Parsing nested protobuf data creates unbounded recursions that can be abused by an attacker.\n\n### Proof of Concept\nFor reproduction details, please refer to the unit tests [decoder_test.py](https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/decoder_test.py#L87-L98) and [message_test](https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/message_test.py#L1436-L1478)\n\n### Remediation and Mitigation\nA mitigation is available now. Please update to the latest available versions of the following packages:\n* protobuf-python(4.25.8, 5.29.5, 6.31.1)","status":"published","published":"2025-06-16T16:02:58Z","modified":"2026-09-10T03:50:25.255076549Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"OESA-2025-1713","title":"protobuf security update","description":"Security Fix(es):\n\nAny project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u0026gt;6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901(CVE-2025-4565)","status":"published","published":"2025-07-04T11:08:48Z","modified":"2026-08-18T01:18:23.313321857Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1714","title":"protobuf security update","description":"Security Fix(es):\n\nAny project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u0026gt;6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901(CVE-2025-4565)","status":"published","published":"2025-07-04T11:08:48Z","modified":"2026-08-18T01:18:23.348005598Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1798","title":"protobuf security update","description":"Security Fix(es):\n\nAny project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u0026gt;6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901(CVE-2025-4565)","status":"published","published":"2025-07-11T11:08:53Z","modified":"2026-08-18T01:18:23.300365811Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1799","title":"protobuf security update","description":"Security Fix(es):\n\nAny project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u0026gt;6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901(CVE-2025-4565)","status":"published","published":"2025-07-11T11:08:53Z","modified":"2026-08-18T01:18:23.298340539Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1800","title":"protobuf security update","description":"Security Fix(es):\n\nAny project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u0026gt;6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901(CVE-2025-4565)","status":"published","published":"2025-07-11T11:08:53Z","modified":"2026-08-18T01:18:23.277389451Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1801","title":"protobuf security update","description":"Security Fix(es):\n\nAny project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u0026gt;6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901(CVE-2025-4565)","status":"published","published":"2025-07-11T11:08:53Z","modified":"2026-08-18T01:18:23.265985478Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"PYSEC-2026-1806","title":"protobuf-python has a potential Denial of Service issue","description":"### Summary\nAny project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of **recursive groups**, **recursive messages** or **a series of [`SGROUP`](https://protobuf.dev/programming-guides/encoding/#groups) tags** can be corrupted by exceeding the Python recursion limit.\n\nReporter: Alexis Challande, Trail of Bits Ecosystem Security Team\n[ecosystem@trailofbits.com](mailto:ecosystem@trailofbits.com)\n\nAffected versions: This issue only affects the [pure-Python implementation](https://github.com/protocolbuffers/protobuf/tree/main/python#implementation-backends) of protobuf-python backend. This is the implementation when `PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python` environment variable is set or the default when protobuf is used from Bazel or pure-Python PyPi wheels. CPython PyPi wheels do not use pure-Python by default.\n\nThis is a Python variant of a [previous issue affecting protobuf-java](https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8).\n\n### Severity\nThis is a potential Denial of Service. Parsing nested protobuf data creates unbounded recursions that can be abused by an attacker.\n\n### Proof of Concept\nFor reproduction details, please refer to the unit tests [decoder_test.py](https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/decoder_test.py#L87-L98) and [message_test](https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/message_test.py#L1436-L1478)\n\n### Remediation and Mitigation\nA mitigation is available now. Please update to the latest available versions of the following packages:\n* protobuf-python(4.25.8, 5.29.5, 6.31.1)","status":"published","published":"2026-07-07T16:02:55.431384Z","modified":"2026-07-07T17:48:07.186137733Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"RHSA-2026:1249","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-04-10T10:04:57Z","modified":"2026-10-20T10:04:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"ROOT-APP-PYPI-CVE-2025-4565","title":"CVE-2025-4565 in protobuf - Patched by Root","description":"Root has patched CVE-2025-4565 in the protobuf package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-10-13T06:52:25Z","modified":"2026-10-13T07:15:05.056235108Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"UBUNTU-CVE-2025-4565","description":"Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u003e6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901","status":"published","published":"2025-06-16T15:15:00Z","modified":"2026-04-22T15:58:34.393465Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"AZL-64116","title":"CVE-2025-4565 affecting package protobuf for versions less than 3.17.3-4","description":"Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u003e6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901","status":"published","published":"2025-06-16T15:15:24Z","modified":"2026-04-21T04:32:18.03216Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"AZL-64145","title":"CVE-2025-4565 affecting package protobuf for versions less than 25.3-5","description":"Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =\u003e6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901","status":"published","published":"2025-06-16T15:15:24Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"CLSA-2025-1762301642","title":"TuxCare security update for protobuf (1 CVE)","description":"TuxCare rebuilt protobuf to address 1 CVE. Fixed in 4.24.3.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-20T13:45:22.685573572Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"openSUSE-SU-2025:15265-1","title":"libprotobuf-lite31_1_0-31.1-1.1 on GA media","description":"These are all security issues fixed in the libprotobuf-lite31_1_0-31.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:34.097978Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:20390-1","title":"Security update for protobuf","description":"This update for protobuf fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2025-4565: Fixed parsing of untrusted Protocol Buffers data containing an arbitrary number of recursive\n  groups or messages that could lead to crash due to RecursionError (bsc#1244663).\n- CVE-2026-0994: Fixed google.protobuf.Any recursion depth bypass in Python json_format.ParseDict (bsc#1257173).\n\nOther fixes:\n\n- Fixed import issues of reverse-dependency packages within the google namespace (bsc#1244918).\n","status":"published","published":"2026-03-18T18:15:53Z","modified":"2026-03-26T17:23:49.861967Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2025:02309-1","title":"Security update for protobuf","description":"This update for protobuf fixes the following issues:\n\n- CVE-2025-4565: Fix parsing of untrusted Protocol Buffers data containing an arbitrary number of recursive groups or messages that can lead to crash due to RecursionError (bsc#1244663).\n","status":"published","published":"2025-07-15T09:14:54Z","modified":"2026-02-04T03:50:55.458793Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02310-1","title":"Security update for protobuf","description":"This update for protobuf fixes the following issues:\n\n- CVE-2025-4565: Fix parsing of untrusted Protocol Buffers data containing an arbitrary number of recursive groups or messages that can lead to crash due to RecursionError (bsc#1244663).\n","status":"published","published":"2025-07-15T09:15:14Z","modified":"2026-02-04T04:14:08.805718Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02311-1","title":"Security update for protobuf","description":"This update for protobuf fixes the following issues:\n\n- CVE-2025-4565: Fix parsing of untrusted Protocol Buffers data containing an arbitrary number of recursive groups or messages that can lead to crash due to RecursionError (bsc#1244663).\n","status":"published","published":"2025-07-15T09:15:50Z","modified":"2026-02-04T04:12:59.598343Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:20514-1","title":"Security update for protobuf","description":"This update for protobuf fixes the following issues:\n\n- CVE-2025-4565: Fixed a crash due to RecursionError (bsc#1244663)\n","status":"published","published":"2025-07-30T09:22:28Z","modified":"2026-03-23T04:47:15.689443Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20672-1","title":"Security update for protobuf","description":"This update for protobuf fixes the following issues:\n\n- CVE-2024-2410: Use after free when parsing JSON from a stream (bsc#1223947).\n- CVE-2024-7254: StackOverflow vulnerability in Protocol Buffers (bsc#1230778).\n- CVE-2025-4565: Parsing of untrusted Protocol Buffers data containing an arbitrary number of recursive groups or messages can lead to crash due to RecursionError (bsc#1244663).\n","status":"published","published":"2025-09-05T12:16:11Z","modified":"2026-03-23T04:49:01.376492Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:3722-1","title":"Security update for protobuf","description":"This update for protobuf fixes the following issues:\n\n- CVE-2025-4565: parsing of untrusted Protocol Buffers data containing an arbitrary number of recursive groups or\n  messages can lead to crash due to a `RecursionError` (bsc#1244663).\n","status":"published","published":"2025-10-22T11:20:32Z","modified":"2026-02-04T02:19:19.080288Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2026:1653-1","title":"Security update for protobuf","description":"This update for protobuf fixes the following issues:\n\nRefresh fixes:\n\n- CVE-2025-4565: parsing of untrusted Protocol Buffers data containing an arbitrary number of recursive groups or\n  messages can lead to crash due to RecursionError (bsc#1244663).\n- CVE-2026-0994: `max_recursion_depth` limit can be bypassed when parsing nested `google.protobuf.Any` messages and lead\n  to the exhaustion of the Python recursion stack (bsc#1257173).\n","status":"published","published":"2026-04-29T00:45:31Z","modified":"2026-04-30T08:15:55.649357Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20753-1","title":"Security update for protobuf","description":"This update for protobuf fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2025-4565: Fixed parsing of untrusted Protocol Buffers data containing an arbitrary number of recursive\n  groups or messages that could lead to crash due to RecursionError (bsc#1244663).\n- CVE-2026-0994: Fixed google.protobuf.Any recursion depth bypass in Python json_format.ParseDict (bsc#1257173).\n\nOther fixes:\n\n- Fixed import issues of reverse-dependency packages within the google namespace (bsc#1244918).\n","status":"published","published":"2026-03-18T18:11:52Z","modified":"2026-03-25T17:23:42.757739Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20907-1","title":"Security update for protobuf","description":"This update for protobuf fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2025-4565: Fixed parsing of untrusted Protocol Buffers data containing an arbitrary number of recursive\n  groups or messages that could lead to crash due to RecursionError (bsc#1244663).\n- CVE-2026-0994: Fixed google.protobuf.Any recursion depth bypass in Python json_format.ParseDict (bsc#1257173).\n\nOther fixes:\n\n- Fixed import issues of reverse-dependency packages within the google namespace (bsc#1244918).\n","status":"published","published":"2026-03-18T18:11:52Z","modified":"2026-04-02T17:33:49.537243Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"USN-7629-1","title":"protobuf vulnerabilities","description":"It was discovered that Protocol Buffers incorrectly handled memory when\nreceiving malicious input using the Python bindings. An attacker could\npossibly use this issue to cause a denial of service. (CVE-2025-4565)\n\nIt was discovered that Protocol Buffers incorrectly handled memory when\nreceiving malicious input using the Java bindings. An attacker could\npossibly use this issue to cause a denial of service. This issue only\naffected Ubuntu 25.04. (CVE-2024-7254)","status":"published","published":"2025-07-09T12:08:30Z","modified":"2026-04-22T11:00:42.998241Z","updated_at":"2026-11-02T16:58:19.988474Z"},{"id":"USN-7629-2","title":"protobuf vulnerabilities","description":"USN-7435-1 and USN-7629-1 fixed vulnerabilities in Protocol Buffers\nfor several releases of Ubuntu. This update provides the corresponding\nfixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that Protocol Buffers incorrectly handled memory when\n receiving malicious input using the Python bindings. An attacker could\n possibly use this issue to cause a denial of service. (CVE-2025-4565)\n\n It was discovered that Protocol Buffers incorrectly handled memory when\n receiving malicious input using the Java bindings. An attacker could\n possibly use this issue to cause a denial of service. This issue only\n affected Ubuntu 25.04. (CVE-2024-7254)","status":"published","published":"2025-09-02T22:03:54Z","modified":"2026-06-25T13:32:30.526345966Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}