CVE-2025-4565
published 2025-06-16CVE-2025-4565: Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.28%
20.0th percentile
Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | protobuf | < protobuf 3.21.12-12 (forky) | protobuf 3.21.12-12 (forky) |
| protobuf | >= 0 < 3.21.12-12 | 3.21.12-12 | |
| protobuf | >= 0 < 4.25.8 | 4.25.8 | |
| protobuf | >= 0 < 3.12.4-1ubuntu7.22.04.4 | 3.12.4-1ubuntu7.22.04.4 | |
| protobuf | >= 0 < 3.21.12-8.2ubuntu0.2 | 3.21.12-8.2ubuntu0.2 | |
| protobuf | >= 0 < 2.6.1-1.3ubuntu0.1~esm4 | 2.6.1-1.3ubuntu0.1~esm4 | |
| protobuf | >= 0 < 3.0.0-9.1ubuntu1.1+esm3 | 3.0.0-9.1ubuntu1.1+esm3 | |
| protobuf | >= 0 < 3.6.1.3-2ubuntu5.2+esm2 | 3.6.1.3-2ubuntu5.2+esm2 | |
| protobuf | >= 5.26.0rc1 < 5.29.5 | 5.29.5 | |
| protobuf | >= 6.30.0rc1 < 6.31.1 | 6.31.1 | |
| protobuf-python | < 4.25.8 | 4.25.8 | |
| protobuf-python | >= 5.26.0 < 5.29.5 | 5.29.5 | |
| protobuf-python | >= 6.30.0 < 6.31.1 | 6.31.1 | |
| msrc | azl3_grpc_1.62.3-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_mysql_8.0.41-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_protobuf_25.3-5_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-tensorboard_2.16.2-6_on_azure_linux_3.0 | — | — |
| msrc | azl3_pytorch_2.2.2-7_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| msrc | cbl2_grpc_1.42.0-11_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_keras_2.11.0-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_protobuf_3.17.3-4_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-tensorboard_2.11.0-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_pytorch_2.0.0-9_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_tensorflow_2.11.1-2_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.7HIGH
vendor_debian8.2HIGH
vendor_redhat8.2HIGH
vendor_ubuntu7.5HIGH
vendor_msrc5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Protocol Buffers vulnerabilities
vendor_ubuntu·2025-09-02·CVSS 7.5
CVE-2024-7254 [HIGH] Protocol Buffers vulnerabilities
Title: Protocol Buffers vulnerabilities
Summary: Protocol Buffers could be made to crash if it received specially crafted
input.
USN-7435-1 and USN-7629-1 fixed vulnerabilities in Protocol Buffers
for several releases of Ubuntu. This update provides the corresponding
fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that Protocol Buffers incorrectly handled memory when
receiving malicious input using the Python bindings. An attacker could
possibly use this issue to cause a denial of service. (CVE-2025-4565)
It was discovered that Protocol Buffers incorrectly handled memory when
receiving malicious input using the Java bindings. An attacker could
possibly use this issue to cause a denial of service. This issue only
affected
Ubuntu
Protocol Buffers vulnerabilities
vendor_ubuntu·2025-07-09·CVSS 7.5
CVE-2024-7254 [HIGH] Protocol Buffers vulnerabilities
Title: Protocol Buffers vulnerabilities
Summary: Protocol Buffers could be made to crash if it received specially crafted
input.
It was discovered that Protocol Buffers incorrectly handled memory when
receiving malicious input using the Python bindings. An attacker could
possibly use this issue to cause a denial of service. (CVE-2025-4565)
It was discovered that Protocol Buffers incorrectly handled memory when
receiving malicious input using the Java bindings. An attacker could
possibly use this issue to cause a denial of service. This issue only
affected Ubuntu 25.04. (CVE-2024-7254)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python-protobuf: Unbounded recursion in Python Protobuf
vendor_redhat·2025-06-16·CVSS 8.2
CVE-2025-4565 [HIGH] CWE-674 python-protobuf: Unbounded recursion in Python Protobuf
python-protobuf: Unbounded recursion in Python Protobuf
Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901
A flaw was found in the python protobuf package which can result in a denial of service. Applications that parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages, or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. T
Microsoft
Unbounded recursion in Python Protobuf
vendor_msrc·2025-06-10·CVSS 5.3
CVE-2025-4565 [HIGH] CWE-674 Unbounded recursion in Python Protobuf
Unbounded recursion in Python Protobuf
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Google: Google
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/
Debian
CVE-2025-4565: protobuf - Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol B...
vendor_debian·2025·CVSS 8.2
CVE-2025-4565 [HIGH] CVE-2025-4565: protobuf - Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol B...
Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 3.21.12-12)
sid: resolved (fixed in 3.21.12-12)
trixie: open
OSV
protobuf vulnerabilities
osv·2025-09-02·CVSS 8.7
CVE-2025-4565 [HIGH] protobuf vulnerabilities
protobuf vulnerabilities
USN-7435-1 and USN-7629-1 fixed vulnerabilities in Protocol Buffers
for several releases of Ubuntu. This update provides the corresponding
fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that Protocol Buffers incorrectly handled memory when
receiving malicious input using the Python bindings. An attacker could
possibly use this issue to cause a denial of service. (CVE-2025-4565)
It was discovered that Protocol Buffers incorrectly handled memory when
receiving malicious input using the Java bindings. An attacker could
possibly use this issue to cause a denial of service. This issue only
affected Ubuntu 25.04. (CVE-2024-7254)
OSV
protobuf vulnerabilities
osv·2025-07-09·CVSS 8.7
CVE-2025-4565 [HIGH] protobuf vulnerabilities
protobuf vulnerabilities
It was discovered that Protocol Buffers incorrectly handled memory when
receiving malicious input using the Python bindings. An attacker could
possibly use this issue to cause a denial of service. (CVE-2025-4565)
It was discovered that Protocol Buffers incorrectly handled memory when
receiving malicious input using the Java bindings. An attacker could
possibly use this issue to cause a denial of service. This issue only
affected Ubuntu 25.04. (CVE-2024-7254)
OSV
protobuf-python has a potential Denial of Service issue
osv·2025-06-16
CVE-2025-4565 [HIGH] protobuf-python has a potential Denial of Service issue
protobuf-python has a potential Denial of Service issue
### Summary
Any project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of **recursive groups**, **recursive messages** or **a series of [`SGROUP`](https://protobuf.dev/programming-guides/encoding/#groups) tags** can be corrupted by exceeding the Python recursion limit.
Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team
[[email protected]](mailto:[email protected])
Affected versions: This issue only affects the [pure-Python implementation](https://github.com/protocolbuffers/protobuf/tree/main/python#implementation-backends) of protobuf-python backend. This is the implementation when `PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python` environme
OSV
CVE-2025-4565: Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recurs
osv·2025-06-16·CVSS 8.2
CVE-2025-4565 [HIGH] CVE-2025-4565: Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recurs
Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901
GHSA
protobuf-python has a potential Denial of Service issue
ghsa·2025-06-16
CVE-2025-4565 [HIGH] CWE-674 protobuf-python has a potential Denial of Service issue
protobuf-python has a potential Denial of Service issue
### Summary
Any project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of **recursive groups**, **recursive messages** or **a series of [`SGROUP`](https://protobuf.dev/programming-guides/encoding/#groups) tags** can be corrupted by exceeding the Python recursion limit.
Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team
[[email protected]](mailto:[email protected])
Affected versions: This issue only affects the [pure-Python implementation](https://github.com/protocolbuffers/protobuf/tree/main/python#implementation-backends) of protobuf-python backend. This is the implementation when `PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python` environme
No detection rules found.
No public exploits indexed.
2025-06-16
Published