Skip to content
Fencer Vulns
medium 5.9

CVE-2025-53605 json

Crash due to uncontrolled recursion in protobuf crate

published 2024-12-12 22 mo ago modified 2026-09-10 1 mo ago also GHSA-2gh3-rmm4-6rq5 , RUSTSEC-2024-0437 , EUVD-2025-20099

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Patch / fix

  • crates.io protobuf 3.7.2
  • stepancheg protobuf 3.7.2
  • rust-protobuf Debian 14 3.7.2-1

debian advisories DEBIAN-CVE-2025-53605

  • kata-containers Azure Linux 3.0 3.19.1.kata2-1
  • rust Azure Linux 3.0 1.75.0-17
  • rust Azure Linux 3.0 1.86.0-4
  • rust CBL-Mariner 2.0 1.72.0-11

azure linux advisories AZL-65556AZL-65565AZL-65568AZL-65592

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-53605 updated cvss 5.9

protobuf: Protobuf: Uncontrolled Recursion Vulnerability

  • Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-cni-rhel9, openshift-service-mesh/istio-pilot-rhel9, openshift-service-mesh/istio-proxyv2-rhel9, openshift-service-mesh/istio-rhel9-operator, openshift-service-mesh/istio-must-gather-rhel9, openshift-service-mesh/istio-sail-operator-bundle, +1 more Red Hat Enterprise Linux 7 protobuf, protobuf-vim, protobuf-java, protobuf-lite, protobuf-emacs, protobuf-python, +3 more Red Hat Enterprise Linux 8 rls, rust, cargo, clippy, rustfmt, protobuf, +12 more Red Hat Enterprise Linux 9 rust, cargo, clippy, rustfmt, rust-gdb, rust-src, +9 more Red Hat Enterprise Linux 10 rust, trustee-guest-components
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenStack Platform 16.2 protobuf, python3-protobuf
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat AMQ Clients protobuf Red Hat Enterprise Linux 9 protobuf, protobuf-lite, python3-protobuf, protobuf-compiler Red Hat Enterprise Linux 10 protobuf Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
16 mo ago

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
crates.io protobuf
<3.7.2
>=0.0.0-0, <3.7.2
3.7.2

Affected products

  • stepancheg protobuf

Classification

Weakness
  • CWE-674 Uncontrolled Recursion
  • CWE-20 Improper Input Validation
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.