CVE-2025-53605 Crash due to uncontrolled recursion in protobuf crate
An attacker can cause a denial of service via uncontrolled recursion in the Rust protobuf library when parsing unknown fields from untrusted input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-53605?
CVE-2025-53605 is a medium-severity denial of service vulnerability in stepancheg protobuf, published on 5 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.
Weakness: CWE-674
Which versions are affected by CVE-2025-53605?
3 open source packages ship an affected version, including protobuf.
| Package | Affected | Fixed in |
|---|---|---|
protobuf crates.io | All versions | 3.7.2 |
protobuf crates.io | All versions | 3.7.2 |
protobuf crates.io | From 0.0.0-0 | 3.7.2 |
How do I fix CVE-2025-53605?
Upgrade protobuf to 3.7.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-53605 being exploited?
There is no known exploitation of CVE-2025-53605 in the wild and no public exploit code.
Sources
Also known as AZL-65556, AZL-65565, AZL-65568, AZL-65574, AZL-65577, AZL-65592 and 11 more.