CVE-2025-4565

Public on 2025-06-16
Modified on 2025-06-19
Description
Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901
Severity
Medium severity
Medium
See what this means
CVSS v3 Base Score
5.9
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 compat-protobuf No Fix Planned
Amazon Linux 2023 grpc Not Affected
Amazon Linux 1 protobuf No Fix Planned
Amazon Linux 2 - Core protobuf Pending Fix
Amazon Linux 2023 protobuf Pending Fix
Amazon Linux 2 - Core protobuf-c Not Affected
Amazon Linux 2023 protobuf-c Not Affected

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H