CLSA-2025-1757017511 protobuf: Fix of CVE-2024-7254

CVE-2024-7254: prevent stack overflow by limiting recursion depth when parsing nested Protocol Buffers data...

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

...

ROS-20250904-06

A vulnerability in the Protobuf Pure-Python structured data serialization library is related to uncontrolled recursion when analyzing unreliable data containing an arbitrary number of recursive groups, recursive messages, or series of SGROUP tags. Exploitation of the vulnerability could allow an...

Parsing issue in protobuf message-type extension

...

RUSTSEC-2025-0157 `statsrelay-protobuf` was removed from crates.io for malicious code

statsrelay-protobuf was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in August 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...

PT-2025-55069

statsrelay-protobuf was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in August 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...

TencentOS Server 4: protobuf (TSSA-2025:0539)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0539 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2021-22569

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small...

Linux Distros Unpatched Vulnerability : CVE-2025-53605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::codedinputstream::CodedInputStream::skipgroup parsing of unknown fields ...

Linux Distros Unpatched Vulnerability : CVE-2021-3121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the skippy peanut butter issue...

ROOT-OS-ALPINE-320-CVE-2024-7254 CVE-2024-7254 in rootio-protobuf - Patched by Root

Root has patched CVE-2024-7254 in the rootio-protobuf package for Root:Alpine:3.20. Multiple fixed versions available...

Medium: rust

Issue Overview: The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::codedinputstream::CodedInputStream::skipgroup parsing of unknown fields in untrusted input. CVE-2025-53605 Affected Packages: rust Issue Correction: Run dnf update rust --releasever...

Linux Distros Unpatched Vulnerability : CVE-2025-4565

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Red Hat Enterprise Linux - python-protobuf: Unbounded recursion in Python Protobuf Ubuntu Linux - Any project that uses Protobuf Pure-Python backend to parse...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2025-1092)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1092 advisory. The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::codedinputstream::CodedInputStream::skipgroup parsing of unknown fields in untrusted input. CVE-2025-53605 Tenabl...

envoy:evaluator_fuzz_test: Use-after-poison in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5161390291877888 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: evaluatorfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Use-after-poison READ 1 Crash Address:...

Amazon Linux 2 : rust (ALAS-2025-2933)

The version of rust installed on the remote host is prior to 1.86.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2933 advisory. The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::codedinputstream::CodedInputStream::skipgroup...

SUSE-SU-2025:20514-1 Security update for protobuf

This update for protobuf fixes the following issues: - CVE-2025-4565: Fixed a crash due to RecursionError bsc1244663...

Security update for protobuf

This update for protobuf fixes the following issues: CVE-2025-4565: Fixed a crash due to RecursionError bsc1244663 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed f...

CBL Mariner 2.0 Security Update: protobuf (CVE-2025-4565)

The version of protobuf installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-4565 advisory. - Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an...

Azure Linux 3.0 Security Update: protobuf (CVE-2025-4565)

The version of protobuf installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-4565 advisory. - Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an...