CVE-2025-4565
Public on 2025-06-16
Modified on 2025-06-19
Description
Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901
Severity
See what this means
CVSS v3 Base Score
See breakdown
Affected Packages
Platform | Package | Release Date | Advisory | Status |
---|---|---|---|---|
Amazon Linux 1 | compat-protobuf | No Fix Planned | ||
Amazon Linux 2023 | grpc | Not Affected | ||
Amazon Linux 1 | protobuf | No Fix Planned | ||
Amazon Linux 2 - Core | protobuf | Pending Fix | ||
Amazon Linux 2023 | protobuf | Pending Fix | ||
Amazon Linux 2 - Core | protobuf-c | Not Affected | ||
Amazon Linux 2023 | protobuf-c | Not Affected |
CVSS Scores
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv3 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |