GitHub Advisoryadvisory · crates.io

GHSA-2gh3-rmm4-6rq5 Crash due to uncontrolled recursion in protobuf crate

MEDIUM Published 2025-03-07 Modified 2025-08-01 Official page ↗
Aliases
CVE-2025-53605
Ecosystem
crates.io
Packages
protobuf
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-20, CWE-770
Reviewed
2025-03-07

Affected packages

• crates.io protobuf: < 3.7.2 → fixed in 3.7.2

Description

Affected version of this crate did not properly parse unknown fields when parsing a user-supplied input. This allows an attacker to cause a stack overflow when parsing the message on untrusted data.

Related

Alias · CVE (1)

  • CVE-2025-53605 The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References