PT-2025-25564

🗓️ 14 May 2025 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 4 Views

Protobuf versions before 6.31.1 are vulnerable to Denial of Service via recursion limit breach.

Reporter	Title	Published	Views	Family All 228
IBM Security Bulletins	Security Bulletin: The IBM Maximo Application Suite AI-Service component uses multiple third-party dependencies that contain vulnerabilities associated with multiple CVEs.	2 Feb 202604:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security vulnerabilities affecting IBM Knowledge Catalog Premium Cartridge	7 Apr 202620:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses protobuf-4.21.12-cp37-abi3-manylinux2014_x86_64.whl and protobuf-4.25.7-cp37-abi3-manylinux2014_x86_64.whl which is vulnerable to CVE-2025-4565	29 May 202608:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	28 Aug 202507:22	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak	25 May 202618:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in protobuf	29 Oct 202510:56	–	ibm
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	26 Feb 202601:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups.	29 Jul 202519:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.	19 Jun 202610:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a RecursionError DOS in protobuf [CVE-2025-4565]	31 Oct 202518:41	–	ibm

Source	Link
osv	www.osv.dev/vulnerability/CVE-2026-44503
osv	www.osv.dev/vulnerability/ghsa-58pv-8j8x-9vj2
osv	www.osv.dev/vulnerability/ghsa-p8q5-cvwx-wvwp
osv	www.osv.dev/vulnerability/CVE-2025-69227
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-21226
osv	www.osv.dev/vulnerability/SUSE-SU-2025:02311-1
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-34519
osv	www.osv.dev/vulnerability/ghsa-r244-wg5g-6w2r
osv	www.osv.dev/vulnerability/CVE-2026-26007
suse	www.suse.com/support/update/announcement/2025/suse-su-20253722-1

07 Jul 2026 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 48.2

CVSS 3.15.3

EPSS0.00281

SSVC

protobuf vulnerability denial of service recursive messages version upgrade python backend