Protobuf Pure-Python 安全漏洞

🗓️ 16 Jun 2025 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd

cnnvd🔗 www.cnnvd.org.cn👁 3 Views

Protobuf Pure-Python vulnerability causing denial of service by exceeding recursion limit when parsing recursive data.

Reporter	Title	Published	Views	Family All 147
IBM Security Bulletins	Security Bulletin: Multiple Security vulnerabilities affecting IBM Knowledge Catalog Premium Cartridge	7 Apr 202620:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses protobuf-4.21.12-cp37-abi3-manylinux2014_x86_64.whl and protobuf-4.25.7-cp37-abi3-manylinux2014_x86_64.whl which is vulnerable to CVE-2025-4565	29 May 202608:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	28 Aug 202507:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in protobuf	29 Oct 202510:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups.	29 Jul 202519:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.	19 Jun 202610:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a RecursionError DOS in protobuf [CVE-2025-4565]	31 Oct 202518:41	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Protobuf Pure-Python backend, IBM Watson Discovery Cartridge is vulnerable to corruption by exceeding the Python recursion limit	14 Nov 202520:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Dictionary uses protobuf-5.28.3-cp38-abi3-manylinux2014_x86_64.whl which is vulnerable to CVE-2025-4565	7 Jul 202507:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in protobuf-5.29.3-cp310-abi3-win32.whl	20 Sep 202511:35	–	ibm

Source	Link
github	www.github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901
access	www.access.redhat.com/security/cve/cve-2025-4565
vigilance	www.vigilance.fr/vulnerability/Protobuf-Pure-Python-denial-of-service-via-Recursion-Limit-47673

25 May 2026 00:00Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.15.3

CVSS 48.2

EPSS0.00281

SSVC

Protobuf Pure Python Recursion Limit Denial of Service Parsing Recursive Data