2376493 – (CVE-2025-53605) CVE-2025-53605 protobuf: Protobuf: Uncontrolled Recursion Vulnerability

Bug 2376493 (CVE-2025-53605) - CVE-2025-53605 protobuf: Protobuf: Uncontrolled Recursion Vulnerability

Summary: CVE-2025-53605 protobuf: Protobuf: Uncontrolled Recursion Vulnerability

Keywords:
Status:	NEW
Alias:	CVE-2025-53605
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	---
Assignee:	Product Security DevOps Team
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:	2376749 2376750 2376751 2376752 2376753
Blocks:
TreeView+	depends on / blocked

Reported:	2025-07-05 02:01 UTC by OSIDB Bzimport
Modified:	2025-07-07 13:32 UTC (History)
CC List:	16 users (show)
Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Description OSIDB Bzimport 2025-07-05 02:01:12 UTC

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Note You need to log in before you can comment on or make changes to this bug.