CVE-2025-4565

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901

References

https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901

Affected packages

Git / github.com/protocolbuffers/protobuf

Affected ranges

Type: GIT
Repo: https://github.com/protocolbuffers/protobuf
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

17838beda2943d08b8a9d4df5b68f5f04f26d901

Introduced

d295af5c3002c08e1bfd9d7f9e175d0a4d015f1e

Fixed

74211c0dfc2777318ab53c2cd2c317a2ef9012de

Introduced

d6511091a0cab1ad13f676a02676ad2a0e5eb9ae

Fixed

f5de0a0495faa63b4186fc767324f8b9a7bf4fc4

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-4565.json"

vanir_signatures

[
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "228606868923603677769672827467256280418",
                "47561640358373228211429691835822805840",
                "43839354369203371833717701412287303719",
                "215908973485308819892957006685588128161"
            ]
        },
        "id": "CVE-2025-4565-28660012",
        "target": {
            "file": "java/core/src/main/java/com/google/protobuf/RuntimeVersion.java"
        },
        "signature_version": "v1",
        "source": "https://github.com/protocolbuffers/protobuf/commit/74211c0dfc2777318ab53c2cd2c317a2ef9012de"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "234249782041082941473730652632081580949",
                "1239930494250163717274066415174407419",
                "67316742155608480760959593469768444953",
                "215908973485308819892957006685588128161"
            ]
        },
        "id": "CVE-2025-4565-4655b7e0",
        "target": {
            "file": "java/core/src/main/java/com/google/protobuf/RuntimeVersion.java"
        },
        "signature_version": "v1",
        "source": "https://github.com/protocolbuffers/protobuf/commit/f5de0a0495faa63b4186fc767324f8b9a7bf4fc4"
    }
]