{"id":"CVE-2025-4565","published":"2025-06-16T14:50:40Z","modified":"2025-06-16T15:39:18Z","title":"Unbounded recursion in Python Protobuf","vendor":"protocolbuffers","product":"Python-Protobuf","tier":"tail","description":{"text":"Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901","provenance":"source","from":"CVE.org"},"cvss":{"score":8.2,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00255,"percentile":0.17102,"provenance":"source"},"cwes":[{"id":"CWE-674","name":"Uncontrolled Recursion"}],"references":[{"url":"https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901","tags":[]}],"priority":{"score":9.2,"factors":[{"name":"EPSS percentile","points":3.42},{"name":"CVSS severity","points":5.74}]},"vendorSlug":"protocolbuffers","affectedVersions":[{"vendor":"protocolbuffers","product":"Python-Protobuf","versions":["< 4.25.8","< 5.29.5","< 6.31.1"]},{"vendor":"protocolbuffers","product":"Python-Protobuf","versions":["< 4.25.8","< 5.29.5","< 6.31.1"]}],"affected":[{"ecosystem":"PyPI","package":"protobuf","vulnerableRanges":["<4.25.8",">=5.26.0rc1, <5.29.5",">=6.30.0rc1, <6.31.1"],"patched":["4.25.8","5.29.5","6.31.1"],"from":["GHSA-8qvm-5x2c-j2w7","PYSEC-2026-1806"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-18401","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-google-protocol-buffers-cve-2024-7254","parents":[{"from":"CVE-2024-7254","to":"CVE-2025-4565","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-8qvm-5x2c-j2w7","via":"reference","url":"https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8"},{"kind":"osv-related","provenance":"source","id":"PYSEC-2026-1806","via":"reference","url":"https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8"}]}],"packageHistory":[{"cve":"CVE-2015-5237","published":"2017-09-25","fixed":"3.4.0","kev":false},{"cve":"CVE-2021-22570","published":"2022-01-26","fixed":"3.15.0","kev":false},{"cve":"CVE-2022-1941","published":"2022-09-22","fixed":"4.21.6","kev":false},{"cve":"CVE-2025-4565","published":"2025-06-16","fixed":"6.31.1","kev":false},{"cve":"CVE-2026-0994","published":"2026-01-23","fixed":"6.33.5","kev":false,"link":{"from":"CVE-2025-4565","to":"CVE-2026-0994","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:protobuf","fromFixed":"6.31.1","toFixed":"6.33.5","daysApart":221},{"kind":"version-step","provenance":"source","package":"PyPI:protobuf","fromFixed":"5.29.5","toFixed":"5.29.6","daysApart":221}]}}],"package":"PyPI:protobuf"}}