protobuf crate 安全漏洞

protobuf crate is a library for Rust by Stepan Koltsov, a personal developer. A security vulnerability exists in protobuf crate versions prior to 3.7.2, which stems from uncontrolled recursion when parsing unknown fields in protobuf::codedinputstream::CodedInputStream::skipgroup...

AlmaLinux 9 : protobuf (ALSA-2025:7138)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:7138 advisory. protobuf: message parsing vulnerability in ProtocolBuffers CVE-2022-1941 Tenable has extracted the preceding description block directly from the AlmaLinux security...

OPENSUSE-SU-2025:15265-1 libprotobuf-lite31_1_0-31.1-1.1 on GA media

These are all security issues fixed in the libprotobuf-lite3110-31.1-1.1 package on the GA media of openSUSE Tumbleweed...

OESA-2025-1689 cri-o security update

Open Container Initiative-based implementation of Kubernetes Container Runtime Interface. Security Fixes: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to protobuf-java (CVE-2024-7254)

Summary protobuf-java is vulnerable to a StackOverflow attack. This vulnerability affects IBM Spectrum Control. CVE-2024-7254. Vulnerability Details CVEID:CVE-2024-7254 DESCRIPTION: Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of...

Denial Of Service (DoS)

Protobuf is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of deeply nested or recursive structures in the Pure-Python backend, leading to a RecursionError...

Security Bulletin: IBM Security Guardium Insights is affected by multiple vulnerabilities

Summary IBM Security Guardium Insights has addressed the following vulnerabilities Vulnerability Details CVEID:CVE-2020-13949 DESCRIPTION: Apache Thrift is vulnerable to a denial of service, caused by improper input validation. By sending specially-crafted messages, a remote attacker could exploi...

Security Bulletin: Security Vulnerability in Protobuf-Java Affects Document Service Container of IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2024-7254)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability in Protobuf-Java. Vulnerability Details CVEID:CVE-2024-7254 DESCRIPTION: Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of...

SUSE CVE-2025-4565

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashin...

CVE-2025-4565

A flaw was found in the python protobuf package which can result in a denial of service. Applications that parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages, or a series of SGROUP tags can be corrupted by exceeding the Python recursion...

alpha-data-py (>=1.0.0, <=1.0.9), beeper-hangups (>=0.5.0a1, <=0.5.0a5) +7 more potentially affected by CVE-2025-4565 via protobuf (3.16.0)

protobuf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - alpha-data-py =1.0.0, =0.5.0a1, =0.0.34, =0.20.5rc3, =0.2.0b1, =0.1.1.1, =4.4.0, =1.0.0, =1.0.1 Source cves: CVE-2025-4565 Source advisory:...

rarecrowds (>=0.0.1, <=0.0.5), sage-engine (2.3.0) +1 more potentially affected by CVE-2025-4565 via protobuf (3.15.7)

protobuf PYPI version 3.15.7 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - rarecrowds =0.0.1, =0.0.5 - sage-engine 2.3.0 - training-grounds 0.0.2 Source cves: CVE-2025-4565 Source advisory: OSV:GHSA-8QVM-5X2C-J2W7...

aerospike-vector-search (>=1.0.0, <=4.2.0), aidbbot (>=0.1.0, <=0.1.2) +383 more potentially affected by CVE-2025-4565 via protobuf (>=5.26.0rc2, <=5.29.4)

protobuf PYPI version =5.26.0rc2, =1.0.0, =0.1.0, =0.82.3, =2.47.9, =0.1.8, =0.0.10, =0.4.1, =1.0.3, =1.0.0, =0.5.0rc2, =0.7.3, =0.9.0, =0.1.16, =1.1.0, =0.3.5, =0.4.1 and more Source cves: CVE-2025-4565 Source advisory: GHSA-8QVM-5X2C-J2W7...

ak-gpapi (>=3.0.4, <=3.0.8), angorapy (>=0.8.0, <=0.8.1) +27 more potentially affected by CVE-2025-4565 via protobuf (3.19.0)

protobuf PYPI version 3.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - ak-gpapi =3.0.4, =0.8.0, =0.1.0, =1.0.1, =0.0.6, =0.6.5, =0.0.1, =1.1.0, =1.1.0, =0.0.4, =0.2.1 and more Source cves: CVE-2025-4565 Source...

cnvrgv2 (>=1.0.0, <=1.0.6), deepomatic-rpc (>=0.8.8, <=0.8.10) +6 more potentially affected by CVE-2025-4565 via protobuf (3.17.2)

protobuf PYPI version 3.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - cnvrgv2 =1.0.0, =0.8.8, =1.0.0, =0.1.0, =1.0.0.dev0, =0.2.5, =0.11.1, =0.12.0 Source cves: CVE-2025-4565 Source advisory: OSV:GHSA-8QVM-5X2C-J2...

admobilizeapis (>=0.0.8, <=0.0.28), bitbox02 (>=0.0.1, <=2.0.0) +13 more potentially affected by CVE-2025-4565 via protobuf (3.7.1)

protobuf PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - admobilizeapis =0.0.8, =0.0.1, =1.1.1, =0.0.0, =1.12.0b2, =0.7.0, =0.2.0, =0.14.0, =1.0.22, =1.0.2, =1.0.8 Source cves: CVE-2025-4565 Source...

arize (>=1.0.4, <=2.1.11), c7n-gcp (0.4.1) +1 more potentially affected by CVE-2025-4565 via protobuf (3.12.0)

protobuf PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - arize =1.0.4, =2.1.11 - c7n-gcp 0.4.1 - wirepas-mesh-messaging 1.2.0 Source cves: CVE-2025-4565 Source advisory: OSV:GHSA-8QVM-5X2C-J2W7...

ahs8p (0.0.1), aioesphomeapi (>=1.7.0, <=2.6.1) +59 more potentially affected by CVE-2025-4565 via protobuf (3.6.1)

protobuf PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - ahs8p 0.0.1 - aioesphomeapi =1.7.0, =0.4.0, =0.4.0, =0.1.5, =0.1.0, =0.1.0, =0.1.1, =0.2.2, =0.1.2, =0.1.1, =0.1.1, =0.1.2, =1.16.0, =1.16.1 and...

adsmsg (>=1.2.0, <=1.3.1), alphalogic-api3 (>=0.0.1, <=0.1.5) +62 more potentially affected by CVE-2025-4565 via protobuf (3.14.0)

protobuf PYPI version 3.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - adsmsg =1.2.0, =0.0.1, =0.1.0, =0.7.2b4, =0.0.1, =1.47.0, =0.0.1.dev50, =1.0.2, =0.4.8, =0.3.5, =2.0.3, =0.1.1, =0.9.1, =0.9.4 and more Source...

protobuf-python has a potential Denial of Service issue

Summary Any project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. Reporter: Alexis Challande, Trail of Bits...