What’s Vulnerable › Vulnerabilities
CVE-2025-4565: Unbounded recursion in Python Protobuf
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-06-16 · updated 2026-06-17
- Weakness: CWE-674
Description
Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901
Affected products
- protocolbuffers Python-Protobuf: before 4.25.8; from 5.26.0 before 5.29.5; from 6.30.0 before 6.31.1 — fixed in 4.25.8, 5.29.5, 6.31.1
How to fix
Upgrade to a fixed version: protocolbuffers Python-Protobuf 4.25.8, 5.29.5, 6.31.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-4565 or the next vulnerability affects your stack