CVE-2025-53605

mediumpriority · track · 0EPSS 0.005 · 41 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.47% (41st) EPSS

CVSS 5.9 · medium

Is it mine?

5 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-28

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

cvss

Technical severity, 0–10. One row per scoring source.

5.9

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.9mediumAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · cve@mitre.org USexploitability 2.2 · impact 3.6

v3.15.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-674USCWE-674USCWE-770US

affected products (5)

Products and version ranges known to be affected.

stepancheg Protobuf0 → 3.7.2enisa_euvdEU
The Rust Foundation protobuf≤ 3.7.2fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 8.0fstec_bduRU
crates.io protobuf< 3.7.2osvUSpkg:cargo/protobuf
crates.io protobuf0.0.0-0 → 3.7.2osvUSpkg:cargo/protobuf

advisories (2)

Vendor and ecosystem advisories describing this.

GHSA-2gh3-rmm4-6rq5Crash due to uncontrolled recursion in protobuf crate2025-03-07ghsa · osvUS
Affected version of this crate did not properly parse unknown fields when parsing a user-supplied input. This allows an attacker to cause a stack overflow when parsing the message on untrusted data.
RUSTSEC-2024-0437Crash due to uncontrolled recursion in protobuf crate2024-12-12vendor · osvUS
Affected version of this crate did not properly parse unknown fields when parsing a user-supplied input. This allows an attacker to cause a stack overflow when parsing the mssage on untrusted data.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv NVD CVE.org MITRE

published 2025-07-05modified 2026-06-17

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan