Protobuf Pure-Python backend can be corrupted by exceeding the Python recursion limit

🗓️ 03 Mar 2026 00:00:00Reported by Broadcom Security ResponseType

broadcom🔗 support.broadcom.com👁 13 Views

Protobuf Pure-Python backend can crash from recursion limit exceed with untrusted data, causing Denial of Service.

Reporter	Title	Published	Views	Family All 144
IBM Security Bulletins	Security Bulletin: Multiple Security vulnerabilities affecting IBM Knowledge Catalog Premium Cartridge	7 Apr 202620:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses protobuf-4.21.12-cp37-abi3-manylinux2014_x86_64.whl and protobuf-4.25.7-cp37-abi3-manylinux2014_x86_64.whl which is vulnerable to CVE-2025-4565	29 May 202608:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	28 Aug 202507:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in protobuf	29 Oct 202510:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups.	29 Jul 202519:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a RecursionError DOS in protobuf [CVE-2025-4565]	31 Oct 202518:41	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Protobuf Pure-Python backend, IBM Watson Discovery Cartridge is vulnerable to corruption by exceeding the Python recursion limit	14 Nov 202520:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Dictionary uses protobuf-5.28.3-cp38-abi3-manylinux2014_x86_64.whl which is vulnerable to CVE-2025-4565	7 Jul 202507:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in protobuf-5.29.3-cp310-abi3-win32.whl	20 Sep 202511:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	28 Aug 202507:21	–	ibm

Vulners

Node

openssh opensshRange<3.4.0

03 Mar 2026 19:47Current

6Medium risk

Vulners AI Score6

CVSS 3.15.3

CVSS 48.2

EPSS0.00016

SSVC