CVE-2025-53605: 
Rust vulnerability analysis and mitigation

The protobuf crate before version 3.7.2 for Rust contains a vulnerability related to uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input. The vulnerability was discovered in July 2025 and assigned CVE-2025-53605 (NVD, RustSec).

The vulnerability exists in the CodedInputStream::skip_group function which exhibits uncontrolled recursion when parsing unknown fields from untrusted input. This issue has been assigned a CVSS v3.1 base score of 5.9 (Medium) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is categorized as CWE-674 (Uncontrolled Recursion) (NVD, RedHat).

The vulnerability can lead to stack overflow when parsing maliciously crafted Protocol Buffer (protobuf) files. This can result in application-level denial of service due to resource exhaustion. The impact primarily affects availability with no direct impact on confidentiality or integrity (RedHat).

The vulnerability has been fixed in protobuf crate version 3.7.2. Users are advised to upgrade to this version or later. For systems where upgrading is not immediately possible, no effective workarounds are currently available that meet security criteria for ease of use and deployment (RedHat).