Uncontrolled Recursion Vulnerability in rust-protobuf Package
Summary
CVE-2025-53605: The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input. Affects rust-protobuf versions < 4cb84f305c05f0376ff51b555a2740c5251c1280. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The rust-protobuf package is a Rust implementation of Google's Protocol Buffers, a language-agnostic binary serialization format. It is widely used for data interchange between services and applications due to its efficiency and ease of use. However, prior to version 3.7.2, the package is susceptible to a vulnerability that allows uncontrolled recursion during the parsing of unknown fields, which can lead to denial of service attacks when processing untrusted input.
Vulnerability Detail
The vulnerability, identified as CVE-2025-53605, arises from the protobuf crate's handling of unknown fields in the protobuf::coded_input_stream::CodedInputStream::skip_group function. When an attacker sends specially crafted input, it can trigger uncontrolled recursion, potentially exhausting system resources and causing the application to crash or become unresponsive. This issue is particularly concerning in environments where untrusted input is processed, as it can lead to significant service disruptions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to ensure that only trusted data is processed by the application. This may involve sanitizing input or limiting the depth of recursion allowed when parsing protobuf messages.
Conclusion
The rust-protobuf package has a significant vulnerability (CVE-2025-53605) that can lead to denial of service through uncontrolled recursion. It is crucial to update to version 3.7.2 or later to mitigate this risk. For those unable to update immediately, implementing input validation can serve as a temporary workaround.
See every vulnerability recorded for rust-protobuf →
FAQ
CVE-2025-53605 is a vulnerability in the rust-protobuf package that allows uncontrolled recursion during the parsing of unknown fields, potentially leading to denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is denial of service, where an attacker can exploit the vulnerability to crash or hang the application by sending specially crafted input.
Yes, the vulnerability is patched in version 3.7.2 of the rust-protobuf package. Updating to this version or later will mitigate the issue.
If an immediate update is not possible, implement input validation to restrict untrusted data and limit recursion depth as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for rust-protobuf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
