Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-53605

Good to know:

icon

Date: July 4, 2025

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Severity Score

Related Resources (10)

https://github.com/stepancheg/rust-protobuf
https://nvd.nist.gov/vuln/detail/CVE-2025-53605
https://crates.io/crates/protobuf
https://rustsec.org/advisories/RUSTSEC-2024-0437
https://security-tracker.debian.org/tracker/CVE-2025-53605
https://github.com/stepancheg/rust-protobuf/issues/749
https://github.com/stepancheg/rust-protobuf/commit/ee1d928785cff80cbdbedde29fbf5210654410f0
https://github.com/stepancheg/rust-protobuf/commit/f06992f46771c0a092593b9ebf7afd48740b3ed6
https://rustsec.org/advisories/RUSTSEC-2024-0437.html
https://www.mend.io/vulnerability-database/CVE-2025-53605

Severity Score

Weakness Type (CWE)

Improper Input Validation

CWE-20

Allocation of Resources Without Limits or Throttling

CWE-770

Uncontrolled Recursion

CWE-674

Top Fix

icon

Upgrade Version

Upgrade to version protobuf - 3.7.2;https://github.com/stepancheg/rust-protobuf.git - v3.7.2

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

Do you need more information?

Contact Us