CVE-2025-4565

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-4565
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4565.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-4565
Aliases
Downstream
AZL (2)
CGA (36)
CLEANSTART (7)
CLSA (1)
DEBIAN (1)
ECHO (1)
MINI (2)
OESA (6)
openSUSE (2)
RHSA (1)
ROOT (1)
SUSE (9)
UBUNTU (1)
Related
openSUSE (2)
SUSE (9)
Published
2025-06-16T14:50:40Z
Modified
2026-10-21T09:16:05Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Unbounded recursion in Python Protobuf
Details

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901

Database specific 
{
    "cna_assigner":  "Google",
    "cwe_ids":  [
        "CWE-674"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4565.json"
}
References

Affected packages

Git / github.com/protocolbuffers/protobuf

Affected ranges

Type
GIT
Repo
https://github.com/protocolbuffers/protobuf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a4cbdd3ed0042e8f9b9c30e8b0634096d9532809
Introduced
d6511091a0cab1ad13f676a02676ad2a0e5eb9ae
Fixed
f5de0a0495faa63b4186fc767324f8b9a7bf4fc4
Introduced
d295af5c3002c08e1bfd9d7f9e175d0a4d015f1e
Fixed
74211c0dfc2777318ab53c2cd2c317a2ef9012de
Fixed
17838beda2943d08b8a9d4df5b68f5f04f26d901
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:google:protobuf-python:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "4.25.8"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:google:protobuf-python:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "5.26.0"
                },
                {
                    "fixed":  "5.29.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:google:protobuf-python:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "6.30.0"
                },
                {
                    "fixed":  "6.31.1"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "17838beda2943d08b8a9d4df5b68f5f04f26d901"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

rust-prerelease-4.*
rust-prerelease-4.30.0-beta1
rust-prerelease-4.31.0-beta1
v2.*
v2.6.0
v2.6.1rc1
v25.*
v25.0-rc1
Other
v26-dev
v27-dev
v28-dev
v29-dev
v30-dev
v31-dev
v29.*
v29.0-rc1
v3.*
v3.0.0-alpha-3
v3.0.0-alpha-4
v3.0.0-beta-1
v3.0.0-beta-1-bzl-fix
v3.0.0-beta-2
v3.0.0-beta-3-pre-1
v3.12.3
v3.20.0-rc2
v3.25.0-rc1
v3.29.0-rc1
v31.*
v31.0-rc1
v4.*
v4.25.0-rc1
v4.31.0-rc1
v5.*
v5.29.0-rc1
v6.*
v6.31.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4565.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "228606868923603677769672827467256280418",
                "47561640358373228211429691835822805840",
                "43839354369203371833717701412287303719",
                "215908973485308819892957006685588128161"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-4565-28660012",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/protocolbuffers/protobuf/commit/74211c0dfc2777318ab53c2cd2c317a2ef9012de",
        "target":  {
            "file":  "java/core/src/main/java/com/google/protobuf/RuntimeVersion.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "234249782041082941473730652632081580949",
                "1239930494250163717274066415174407419",
                "67316742155608480760959593469768444953",
                "215908973485308819892957006685588128161"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-4565-4655b7e0",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/protocolbuffers/protobuf/commit/f5de0a0495faa63b4186fc767324f8b9a7bf4fc4",
        "target":  {
            "file":  "java/core/src/main/java/com/google/protobuf/RuntimeVersion.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T09:16:05Z"