protobuf-python has a potential Denial of Service issue

🗓️ 16 Jun 2025 16:02:58Reported by GitHub Advisory DatabaseType

Denial of Service risk in protobuf-python affects parsing of untrusted Protocol Buffers data.

Reporter	Title	Published	Views	Family All 144
IBM Security Bulletins	Security Bulletin: Multiple Security vulnerabilities affecting IBM Knowledge Catalog Premium Cartridge	7 Apr 202620:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses protobuf-4.21.12-cp37-abi3-manylinux2014_x86_64.whl and protobuf-4.25.7-cp37-abi3-manylinux2014_x86_64.whl which is vulnerable to CVE-2025-4565	29 May 202608:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	28 Aug 202507:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in protobuf	29 Oct 202510:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups.	29 Jul 202519:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a RecursionError DOS in protobuf [CVE-2025-4565]	31 Oct 202518:41	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Protobuf Pure-Python backend, IBM Watson Discovery Cartridge is vulnerable to corruption by exceeding the Python recursion limit	14 Nov 202520:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Dictionary uses protobuf-5.28.3-cp38-abi3-manylinux2014_x86_64.whl which is vulnerable to CVE-2025-4565	7 Jul 202507:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in protobuf-5.29.3-cp310-abi3-win32.whl	20 Sep 202511:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	28 Aug 202507:21	–	ibm

Vulners

Node

protobuf protobufRange6.30.0rc1–6.31.1pip

protobuf protobufRange5.26.0rc1–5.29.5pip

protobuf protobufRange<4.25.8pip

Source	Link
github	www.github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8
github	www.github.com/protocolbuffers/protobuf/security/advisories/GHSA-8qvm-5x2c-j2w7
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-4565
github	www.github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901
github	www.github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/decoder_test.py
github	www.github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/message_test.py
github	www.github.com/protocolbuffers/protobuf/tree/main/python
github	www.github.com/advisories/GHSA-8qvm-5x2c-j2w7

16 Jun 2025 16:03Current

7.2High risk

Vulners AI Score7.2

CVSS 3.15.3

CVSS 48.2

EPSS0.00016

SSVC

CWE-674