The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade cargoUpgrade rust-toolsetUpgrade rust-toolset-srpm-macrosUpgrade rust-docUpgrade rust-gdbUpgrade rustfmtUpgrade rust-srcUpgrade rust-analyzerUpgrade clippyUpgrade rustUpgrade rust-debugger-commonUpgrade rust-std-static | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade cargo-debuginfoUpgrade clippy-debuginfoUpgrade rustUpgrade rust-std-static-wasm32-unknown-unknownUpgrade rust-debugsourceUpgrade rust-lldbUpgrade rustfmtUpgrade rust-gdbUpgrade rust-std-staticUpgrade rust-toolsetUpgrade rust-debuginfoUpgrade rust-analyzerUpgrade rust-debugger-commonUpgrade cargoUpgrade rust-toolset-srpm-macrosUpgrade rust-analyzer-debuginfoUpgrade rust-srcUpgrade rust-docUpgrade rustfmt-debuginfoUpgrade rust-std-static-wasm32-wasip1Upgrade clippy | Jul 30, 2025 | Jul 5, 2025 |
| Debian | — | No solution exists | Jul 7, 2025 | Jul 5, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub