CVE-2025-53605: Input Validation
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2gh3-rmm4-6rq5. This link is maintained to preserve external references.
The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::codedinputstream::CodedInputStream::skipgroup parsing of unknown fields in untrusted input.
Other sources
Affected version of this crate did not properly parse unknown fields when parsing a user-supplied input.
This allows an attacker to cause a stack overflow when parsing the message on untrusted data.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53605?
CVE-2025-53605 is classified as a medium severity vulnerability due to its potential for causing denial of service through uncontrolled recursion.
How do I fix CVE-2025-53605?
To fix CVE-2025-53605, upgrade the protobuf crate to version 3.7.2 or later.
What software is affected by CVE-2025-53605?
CVE-2025-53605 affects the protobuf crate for Rust versions earlier than 3.7.2.
What kind of attack does CVE-2025-53605 allow?
CVE-2025-53605 allows attackers to cause uncontrolled recursion when processing untrusted input, potentially leading to denial of service.
Is CVE-2025-53605 specific to a particular programming language?
Yes, CVE-2025-53605 specifically affects the Rust programming language through the protobuf crate.