Uncontrolled Recursion Vulnerability in rust-protobuf Package
Summary
DEBIAN-CVE-2025-53605: The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input. Affects rust-protobuf versions 2.27.1-1 – 3.7.2-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rust-protobuf package is a Rust implementation of Protocol Buffers, a language-agnostic binary serialization format developed by Google. It is widely used for data interchange in applications due to its efficiency and ease of use. However, the package has been found to have a vulnerability that allows for uncontrolled recursion when parsing unknown fields in untrusted input, which can lead to denial of service or application crashes.
Vulnerability Detail
The vulnerability identified as CVE-2025-53605 affects the protobuf crate before version 3.7.2. It allows for uncontrolled recursion in the parsing of unknown fields within the protobuf::coded_input_stream::CodedInputStream::skip_group method. This can be exploited by an attacker who sends specially crafted input to the application, potentially leading to stack overflow, excessive resource consumption, or application crashes. The issue arises from the lack of proper input validation and handling of recursive structures in the parsing logic.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not immediately possible, consider implementing input validation to restrict the size and complexity of the input being processed. This can help mitigate the risk of exploitation until a proper update can be applied.
Conclusion
The rust-protobuf package has a significant vulnerability (CVE-2025-53605) that allows for uncontrolled recursion during input parsing. It is crucial to update to the patched version 3.7.2-1 to mitigate the risks associated with this vulnerability. Until an update can be applied, implementing input validation can serve as a temporary workaround.
See every vulnerability recorded for rust-protobuf →
FAQ
CVE-2025-53605 is a vulnerability in the rust-protobuf package that allows for uncontrolled recursion during the parsing of unknown fields, potentially leading to application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include denial of service, application crashes, and excessive resource consumption due to uncontrolled recursion.
Yes, a patch is available in version 3.7.2-1 of the rust-protobuf package.
Implement input validation to limit the size and complexity of input until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for rust-protobuf.
