Vulnerability · Published Jun 16, 2025 · Assigned by Google
CVE-2025-4565Unbounded recursion in Python Protobuf
High 8.2
In plain English
A high-severity security flaw in Python-Protobuf from protocolbuffers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | protobuf | 3.21.12-3+deb12u1 | DEBIAN-CVE-2025-4565 |
| Debian:13 | protobuf | 3.21.12-11+deb13u1 | DEBIAN-CVE-2025-4565 |
| Debian:14 | protobuf | 3.21.12-12 | DEBIAN-CVE-2025-4565 |
| PyPI | protobuf | 4.25.8, 5.29.5, 6.31.1 | PYSEC-2026-1806 |
| PyPI | protobuf | 5.29.5 | GHSA-8qvm-5x2c-j2w7 |
| PyPI | protobuf | 4.25.8 | GHSA-8qvm-5x2c-j2w7 |
| PyPI | protobuf | 6.31.1 | GHSA-8qvm-5x2c-j2w7 |
| Ubuntu:22.04:LTS | protobuf | 3.12.4-1ubuntu7.22.04.4 | USN-7629-1 |
| Ubuntu:22.04:LTS | protobuf | 3.12.4-1ubuntu7.22.04.4 | UBUNTU-CVE-2025-4565 |
| Ubuntu:24.04:LTS | protobuf | 3.21.12-8.2ubuntu0.2 | UBUNTU-CVE-2025-4565 |
| Ubuntu:24.04:LTS | protobuf | 3.21.12-8.2ubuntu0.2 | USN-7629-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| protocolbuffers | Python-Protobuf | 0 – before 4.25.80 – before 5.29.50 – before 6.31.1 |
| protocolbuffers | Python-Protobuf | 0 – before 4.25.80 – before 5.29.50 – before 6.31.1 |
Weakness: CWE-674 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N