The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade cargoUpgrade rust-srcUpgrade rust-toolsetUpgrade rustfmtUpgrade rust-docUpgrade rust-toolset-srpm-macrosUpgrade rust-gdbUpgrade rust-analyzerUpgrade clippyUpgrade rustUpgrade rust-std-staticUpgrade rust-debugger-common | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade rustfmt-debuginfoUpgrade rust-analyzer-debuginfoUpgrade rust-std-static-wasm32-wasip1Upgrade rust-srcUpgrade rust-docUpgrade rust-toolset-srpm-macrosUpgrade cargoUpgrade clippyUpgrade rust-debugger-commonUpgrade rust-debuginfoUpgrade rust-analyzerUpgrade rust-debugsourceUpgrade rust-gdbUpgrade rust-std-staticUpgrade rust-toolsetUpgrade rustUpgrade cargo-debuginfoUpgrade rust-lldbUpgrade clippy-debuginfoUpgrade rust-std-static-wasm32-unknown-unknownUpgrade rustfmt | Jul 30, 2025 | Jul 5, 2025 |
| Debian | — | No solution exists | Jul 7, 2025 | Jul 5, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub