CVE catalog

CVE-2025-4565

Protocol Buffers vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.26% · Oct 25, 2026

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianprotobufsid3.21.12-17fixed
Debianprotobufforky3.21.12-17fixed
Debianprotobuftrixie3.21.12-11+deb13u1fixed
Debianprotobufbookworm3.21.12-3+deb12u1fixed
Ubuntuprotobufnoble3.21.12-3+deb12u1fixed
Ubuntuprotobufnoble3.21.12-8.2ubuntu0.2fixed
Ubuntuelpa-protobuf-modenoble3.21.12-8.2ubuntu0.2fixed
Ubuntulibprotobuf-devnoble3.21.12-8.2ubuntu0.2fixed
Ubuntulibprotobuf-javanoble3.21.12-8.2ubuntu0.2fixed
Ubuntulibprotobuf-lite32t64noble3.21.12-8.2ubuntu0.2fixed
Ubuntulibprotobuf32t64noble3.21.12-8.2ubuntu0.2fixed
Ubuntulibprotoc-devnoble3.21.12-8.2ubuntu0.2fixed
Ubuntulibprotoc32t64noble3.21.12-8.2ubuntu0.2fixed
Ubuntuphp-google-protobufnoble3.21.12-8.2ubuntu0.2fixed
Ubuntuprotobuf-compilernoble3.21.12-8.2ubuntu0.2fixed
Ubuntupython3-protobufnoble3.21.12-8.2ubuntu0.2fixed
Ubunturuby-google-protobufnoble3.21.12-8.2ubuntu0.2fixed
PyPIprotobufNot reported6.31.1fixed
PyPIprotobufNot reported5.29.5fixed
PyPIprotobufNot reported6.31.1fixed
PyPIprotobufNot reported6.31.1fixed
PyPIprotobufNot reported4.25.8fixed
PyPIprotobufNot reported5.29.5fixed
Ubuntuprotobufpro3.6.1.3-2vulnerable
Ubuntuprotobufpro3.6.1.3-2ubuntu1vulnerable
Ubuntuprotobufpro3.6.1.3-2ubuntu3vulnerable
Ubuntuprotobufpro3.6.1.3-2ubuntu4vulnerable
Ubuntuprotobufpro3.6.1.3-2ubuntu5vulnerable
Ubuntuprotobufpro3.6.1.3-2ubuntu5.2vulnerable
Ubuntuprotobufpro3.6.1.3-2ubuntu5.2+esm2fixed
Ubuntuprotobuf22.043.12.4-1ubuntu3vulnerable
Ubuntuprotobuf22.043.12.4-1ubuntu5vulnerable
Ubuntuprotobuf22.043.12.4-1ubuntu6vulnerable
Ubuntuprotobuf22.043.12.4-1ubuntu7vulnerable
Ubuntuprotobuf22.043.12.4-1ubuntu7.22.04.1vulnerable
Ubuntuprotobuf22.043.12.4-1ubuntu7.22.04.2vulnerable
Ubuntuprotobuf22.043.12.4-1ubuntu7.22.04.4fixed
Ubuntuprotobuf24.043.21.12-7ubuntu1vulnerable
Ubuntuprotobuf24.043.21.12-8ubuntu1vulnerable
Ubuntuprotobuf24.043.21.12-8ubuntu5vulnerable
Ubuntuprotobuf24.043.21.12-8.2vulnerable
Ubuntuprotobuf24.043.21.12-8.2build1vulnerable
Ubuntuprotobuf24.043.21.12-8.2ubuntu0.1vulnerable
Ubuntuprotobuf24.043.21.12-8.2ubuntu0.2fixed
Suseprotobuflinux enterprise server 16.028.3-160000.3.1fixed
Suseprotobuf-javalinux enterprise server 16.028.3-160000.3.1fixed
Susepython-protobuflinux enterprise server 16.05.28.3-160000.3.1fixed
Suseprotobuflinux enterprise server for sap applications 16.028.3-160000.3.1fixed
Suseprotobuf-javalinux enterprise server for sap applications 16.028.3-160000.3.1fixed
Susepython-protobuflinux enterprise server for sap applications 16.05.28.3-160000.3.1fixed
Opensuseprotobufleap 16.028.3-160000.3.1fixed
Opensuseprotobuf-javaleap 16.028.3-160000.3.1fixed
Opensusepython-protobufleap 16.05.28.3-160000.3.1fixed
Suseprotobuflinux micro 6.228.3-160000.3.1fixed
Opensuseprotobuftumbleweed31.1-1.1fixed
Suseprotobuflinux micro 6.023.4-10.1fixed
Suseprotobuflinux enterprise micro 5.525.1-150500.12.11.1fixed
Suseprotobuflinux enterprise module for public cloud 15 sp525.1-150500.12.11.1fixed
Suseprotobuflinux enterprise module for basesystem 15 sp625.1-150600.16.13.1fixed
Suseprotobuflinux enterprise module for basesystem 15 sp725.1-150600.16.13.1fixed
Suseprotobuflinux enterprise module for development tools 15 sp625.1-150600.16.13.1fixed
Suseprotobuflinux enterprise module for development tools 15 sp725.1-150600.16.13.1fixed
Suseprotobuflinux enterprise module for package hub 15 sp625.1-150600.16.13.1fixed
Suseprotobuflinux enterprise module for python 3 15 sp625.1-150600.16.13.1fixed
Suseprotobuflinux enterprise module for python 3 15 sp725.1-150600.16.13.1fixed
Opensuseprotobufleap 15.625.1-150600.16.13.1fixed
Suseprotobuflinux enterprise micro 5.325.1-150400.9.16.1fixed
Suseprotobuflinux enterprise micro 5.425.1-150400.9.16.1fixed
Suseprotobuflinux enterprise module for public cloud 15 sp425.1-150400.9.16.1fixed
Suseprotobufmanager server module 4.325.1-150400.9.16.1fixed
Suseprotobuflinux enterprise micro 5.33.9.2-150200.4.27.1fixed
Suseprotobuflinux enterprise micro 5.43.9.2-150200.4.27.1fixed
Suseprotobuflinux enterprise micro 5.53.9.2-150200.4.27.1fixed
Suseprotobuflinux enterprise module for basesystem 15 sp63.9.2-150200.4.27.1fixed
Suseprotobuflinux enterprise module for basesystem 15 sp73.9.2-150200.4.27.1fixed
Suseprotobuflinux enterprise module for package hub 15 sp63.9.2-150200.4.27.1fixed
Suseprotobuflinux enterprise module for package hub 15 sp73.9.2-150200.4.27.1fixed
Suseprotobuflinux enterprise module for public cloud 15 sp33.9.2-150200.4.27.1fixed
Suseprotobuflinux enterprise module for public cloud 15 sp43.9.2-150200.4.27.1fixed
Suseprotobuflinux enterprise module for public cloud 15 sp53.9.2-150200.4.27.1fixed
Suseprotobuflinux enterprise module for public cloud 15 sp63.9.2-150200.4.27.1fixed
Suseprotobuflinux enterprise module for public cloud 15 sp73.9.2-150200.4.27.1fixed
Suseprotobuflinux enterprise micro 5.13.9.2-150200.4.27.1fixed
Suseprotobuflinux enterprise micro 5.23.9.2-150200.4.27.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianprotobufsourcesid3.21.12-12not yet assignedNot reported[1108057]
Debianprotobufsourceforky3.21.12-12not yet assignedNot reported[1108057]
Debianprotobufsourcetrixie3.21.12-11+deb13u1not yet assignedNot reported[1108057]
Debianprotobufsourcebookworm3.21.12-3+deb12u1not yet assignedNot reported[1108057]
Ubuntuprotobufdebnoble3.21.12-3+deb12u1Not reportedNot reportedNot reported
Ubuntuprotobufdebnoble3.21.12-8.2ubuntu0.2Not reportedNot reportedNot reported
Ubuntuelpa-protobuf-modedebnoble3.21.12-8.2ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibprotobuf-devdebnoble3.21.12-8.2ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibprotobuf-javadebnoble3.21.12-8.2ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibprotobuf-lite32t64debnoble3.21.12-8.2ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibprotobuf32t64debnoble3.21.12-8.2ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibprotoc-devdebnoble3.21.12-8.2ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibprotoc32t64debnoble3.21.12-8.2ubuntu0.2Not reportedNot reportedNot reported
Ubuntuphp-google-protobufdebnoble3.21.12-8.2ubuntu0.2Not reportedNot reportedNot reported
Ubuntuprotobuf-compilerdebnoble3.21.12-8.2ubuntu0.2Not reportedNot reportedNot reported
Ubuntupython3-protobufdebnoble3.21.12-8.2ubuntu0.2Not reportedNot reportedNot reported
Ubunturuby-google-protobufdebnoble3.21.12-8.2ubuntu0.2Not reportedNot reportedNot reported
PyPIprotobufPyPINot reported6.31.1Not reportedGHSA-8QVM-5X2C-J2W7Not reported
PyPIprotobufPyPINot reported5.29.5Not reportedNot reportedNot reported
PyPIprotobufPyPINot reported6.31.1Not reportedNot reportedNot reported
PyPIprotobufPyPINot reported6.31.1Not reportedNot reportedNot reported
PyPIprotobufPyPINot reported4.25.8Not reportedNot reportedNot reported
PyPIprotobufPyPINot reported5.29.5Not reportedNot reportedNot reported
Ubuntuprotobufdebpro3.6.1.3-2ubuntu5.2+esm2Not reportedUBUNTU-CVE-2025-4565Not reported
Ubuntuprotobufdeb22.043.12.4-1ubuntu7.22.04.4Not reportedUBUNTU-CVE-2025-4565Not reported
Ubuntuprotobufdeb24.043.21.12-8.2ubuntu0.2Not reportedUBUNTU-CVE-2025-4565Not reported
Suseprotobufrpmlinux enterprise server 16.028.3-160000.3.1Not reportedSUSE-SU-2026:20907-1Not reported
Suseprotobuf-javarpmlinux enterprise server 16.028.3-160000.3.1Not reportedSUSE-SU-2026:20907-1Not reported
Susepython-protobufrpmlinux enterprise server 16.05.28.3-160000.3.1Not reportedSUSE-SU-2026:20907-1Not reported
Suseprotobufrpmlinux enterprise server for sap applications 16.028.3-160000.3.1Not reportedSUSE-SU-2026:20907-1Not reported
Suseprotobuf-javarpmlinux enterprise server for sap applications 16.028.3-160000.3.1Not reportedSUSE-SU-2026:20907-1Not reported
Susepython-protobufrpmlinux enterprise server for sap applications 16.05.28.3-160000.3.1Not reportedSUSE-SU-2026:20907-1Not reported
Opensuseprotobufrpmleap 16.028.3-160000.3.1Not reportedOPENSUSE-SU-2026:20390-1Not reported
Opensuseprotobuf-javarpmleap 16.028.3-160000.3.1Not reportedOPENSUSE-SU-2026:20390-1Not reported
Opensusepython-protobufrpmleap 16.05.28.3-160000.3.1Not reportedOPENSUSE-SU-2026:20390-1Not reported
Suseprotobufrpmlinux micro 6.228.3-160000.3.1Not reportedSUSE-SU-2026:20753-1Not reported
Opensuseprotobufrpmtumbleweed31.1-1.1Not reportedOPENSUSE-SU-2025:15265-1Not reported
Suseprotobufrpmlinux micro 6.023.4-10.1Not reportedSUSE-SU-2025:20514-1Not reported
Suseprotobufrpmlinux enterprise micro 5.525.1-150500.12.11.1Not reportedSUSE-SU-2025:02310-1Not reported
Suseprotobufrpmlinux enterprise module for public cloud 15 sp525.1-150500.12.11.1Not reportedSUSE-SU-2025:02310-1Not reported
Suseprotobufrpmlinux enterprise module for basesystem 15 sp625.1-150600.16.13.1Not reportedSUSE-SU-2025:02311-1Not reported
Suseprotobufrpmlinux enterprise module for basesystem 15 sp725.1-150600.16.13.1Not reportedSUSE-SU-2025:02311-1Not reported
Suseprotobufrpmlinux enterprise module for development tools 15 sp625.1-150600.16.13.1Not reportedSUSE-SU-2025:02311-1Not reported
Suseprotobufrpmlinux enterprise module for development tools 15 sp725.1-150600.16.13.1Not reportedSUSE-SU-2025:02311-1Not reported
Suseprotobufrpmlinux enterprise module for package hub 15 sp625.1-150600.16.13.1Not reportedSUSE-SU-2025:02311-1Not reported
Suseprotobufrpmlinux enterprise module for python 3 15 sp625.1-150600.16.13.1Not reportedSUSE-SU-2025:02311-1Not reported
Suseprotobufrpmlinux enterprise module for python 3 15 sp725.1-150600.16.13.1Not reportedSUSE-SU-2025:02311-1Not reported
Opensuseprotobufrpmleap 15.625.1-150600.16.13.1Not reportedSUSE-SU-2025:02311-1Not reported
Suseprotobufrpmlinux enterprise micro 5.325.1-150400.9.16.1Not reportedSUSE-SU-2025:02309-1Not reported
Suseprotobufrpmlinux enterprise micro 5.425.1-150400.9.16.1Not reportedSUSE-SU-2025:02309-1Not reported
Suseprotobufrpmlinux enterprise module for public cloud 15 sp425.1-150400.9.16.1Not reportedSUSE-SU-2025:02309-1Not reported
Suseprotobufrpmmanager server module 4.325.1-150400.9.16.1Not reportedSUSE-SU-2025:02309-1Not reported
Suseprotobufrpmlinux enterprise micro 5.33.9.2-150200.4.27.1Not reportedSUSE-SU-2025:3722-1Not reported
Suseprotobufrpmlinux enterprise micro 5.43.9.2-150200.4.27.1Not reportedSUSE-SU-2025:3722-1Not reported
Suseprotobufrpmlinux enterprise micro 5.53.9.2-150200.4.27.1Not reportedSUSE-SU-2025:3722-1Not reported
Suseprotobufrpmlinux enterprise module for basesystem 15 sp63.9.2-150200.4.27.1Not reportedSUSE-SU-2025:3722-1Not reported
Suseprotobufrpmlinux enterprise module for basesystem 15 sp73.9.2-150200.4.27.1Not reportedSUSE-SU-2025:3722-1Not reported
Suseprotobufrpmlinux enterprise module for package hub 15 sp63.9.2-150200.4.27.1Not reportedSUSE-SU-2025:3722-1Not reported
Suseprotobufrpmlinux enterprise module for package hub 15 sp73.9.2-150200.4.27.1Not reportedSUSE-SU-2025:3722-1Not reported
Suseprotobufrpmlinux enterprise module for public cloud 15 sp33.9.2-150200.4.27.1Not reportedSUSE-SU-2025:3722-1Not reported
Suseprotobufrpmlinux enterprise module for public cloud 15 sp43.9.2-150200.4.27.1Not reportedSUSE-SU-2025:3722-1Not reported
Suseprotobufrpmlinux enterprise module for public cloud 15 sp53.9.2-150200.4.27.1Not reportedSUSE-SU-2025:3722-1Not reported
Suseprotobufrpmlinux enterprise module for public cloud 15 sp63.9.2-150200.4.27.1Not reportedSUSE-SU-2025:3722-1Not reported
Suseprotobufrpmlinux enterprise module for public cloud 15 sp73.9.2-150200.4.27.1Not reportedSUSE-SU-2025:3722-1Not reported
Suseprotobufrpmlinux enterprise micro 5.13.9.2-150200.4.27.1Not reportedSUSE-SU-2025:3722-1Not reported
Suseprotobufrpmlinux enterprise micro 5.23.9.2-150200.4.27.1Not reportedSUSE-SU-2025:3722-1Not reported

[Debian bug #1108057]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • Source package: [protobuf]

    Details (1)
    • 34.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 31.1-1.1

      Version impact unknown

      usn · protobuf · opensuse · tumbleweed

  • Source package: [protobuf]

    Details (1)
    • 34.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 31.1-1.1

      Version impact unknown

      usn · protobuf · opensuse · tumbleweed

  • Source package: [protobuf]

    Details (1)
    • 34.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 31.1-1.1

      Version impact unknown

      usn · protobuf · opensuse · tumbleweed

  • Source package: [protobuf]

    Details (1)
    • 34.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 31.1-1.1

      Version impact unknown

      usn · protobuf · opensuse · tumbleweed

  • Source package: [protobuf]

    Details (1)
    • 34.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 31.1-1.1

      Version impact unknown

      usn · protobuf · opensuse · tumbleweed

  • Source package: [protobuf]

    Details (1)
    • 34.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 31.1-1.1

      Version impact unknown

      usn · protobuf · opensuse · tumbleweed

  • Source package: [protobuf]

    Details (1)
    • 34.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 31.1-1.1

      Version impact unknown

      usn · protobuf · opensuse · tumbleweed

  • Source package: [protobuf]

    Details (1)
    • 34.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 31.1-1.1

      Version impact unknown

      usn · protobuf · opensuse · tumbleweed

  • Source package: [protobuf]

    Details (1)
    • 34.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 31.1-1.1

      Version impact unknown

      usn · protobuf · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • Source package: [protobuf]

    Details (2)
    • 3.21.12-3+deb12u1 · all · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · all · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

  • Source package: [protobuf]

    Details (2)
    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

  • Source package: [protobuf]

    Details (2)
    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

  • Source package: [protobuf]

    Details (2)
    • 3.21.12-3+deb12u1 · all · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · all · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

  • Source package: [protobuf]

    Details (2)
    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

  • Source package: [protobuf]

    Details (2)
    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

  • Source package: [protobuf]

    Details (2)
    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

  • Source package: [protobuf]

    Details (2)
    • 3.21.12-3+deb12u1 · all · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · all · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

  • Source package: [protobuf]

    Details (2)
    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

  • Source package: [protobuf]

    Details (2)
    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

  • Source package: [protobuf]

    Details (2)
    • 3.21.12-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

    • 3.21.12-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.21.12-3+deb12u1

      usn · protobuf · debian · bookworm; usn · protobuf · debian · 12

Next results

Observed:

References