CVE-2025-53605
BaseFortify
Publication date: 2025-07-05
Last updated on: 2025-07-08
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-674 | The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Rust protobuf crate versions up to 3.4.0, where the function protobuf::coded_input_stream::CodedInputStream::skip_group improperly handles unknown fields during parsing of untrusted input. This improper handling leads to uncontrolled recursion, which can cause a stack overflow and potentially crash the application. [1]
How can this vulnerability impact me? :
The vulnerability can cause a denial-of-service (DoS) condition by triggering a stack overflow through uncontrolled recursion when parsing malicious or untrusted input. This can crash applications using the affected protobuf crate, leading to service interruptions. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves uncontrolled recursion in the protobuf crate when parsing unknown fields, leading to a denial-of-service via stack overflow. Detection would involve monitoring for crashes or stack overflow errors in applications using vulnerable versions of the protobuf crate (up to 3.4.0). There are no specific commands provided to detect this vulnerability on a network or system in the provided resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the protobuf crate to version 3.7.2 or later, where the vulnerability has been patched. Avoid using vulnerable versions (up to 3.4.0) in your Rust projects to prevent denial-of-service conditions caused by this issue. [1]