EUVD-2025-18401

| CVE-2025-4565 MEDIUM
2025-06-16 [email protected] GHSA-8qvm-5x2c-j2w7
5.3
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

4
Analysis Generated
Mar 14, 2026 - 21:59 vuln.today
EUVD ID Assigned
Mar 14, 2026 - 21:59 euvd
EUVD-2025-18401
Patch Released
Mar 14, 2026 - 21:59 nvd
Patch available
CVE Published
Jun 16, 2025 - 15:15 nvd
MEDIUM 5.3

Tags

Python Denial Of Service Ubuntu Debian Protobuf Python Redhat Suse

Description

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901

Analysis

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901

Technical Context

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Uncontrolled Recursion (CWE-674).

Affected Products

Affected products: Google Protobuf-Python

Remediation

A vendor patch is available — apply it immediately. Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.

Priority Score

27
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +26
POC: 0

Vendor Status

Ubuntu

Priority: Medium
protobuf
Release Status Version
upstream released 6.31.1
jammy released 3.12.4-1ubuntu7.22.04.4
noble released 3.21.12-8.2ubuntu0.2
oracular ignored end of life
plucky released 3.21.12-10ubuntu0.1
bionic released 3.0.0-9.1ubuntu1.1+esm3
focal released 3.6.1.3-2ubuntu5.2+esm2
trusty ignored changes too intrusive
xenial released 2.6.1-1.3ubuntu0.1~esm4
USN-7629-1 USN-7629-2

Debian

Bug #1108057
protobuf
Release Status Fixed Version Urgency
bullseye vulnerable 3.12.4-1+deb11u1 -
bookworm vulnerable 3.21.12-3 -
trixie vulnerable 3.21.12-11 -
forky, sid fixed 3.21.12-15 -
(unstable) fixed 3.21.12-12 -

Share

EUVD-2025-18401 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy