The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade cargoUpgrade rust-srcUpgrade rust-gdbUpgrade rust-toolset-srpm-macrosUpgrade rustfmtUpgrade rust-analyzerUpgrade rust-docUpgrade rust-toolsetUpgrade rust-debugger-commonUpgrade clippyUpgrade rustUpgrade rust-std-static | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade rustfmtUpgrade rust-debuginfoUpgrade cargo-debuginfoUpgrade rust-analyzerUpgrade rust-lldbUpgrade rust-toolsetUpgrade rustUpgrade rust-debugsourceUpgrade rust-gdbUpgrade rust-debugger-commonUpgrade rust-std-static-wasm32-unknown-unknownUpgrade rust-std-staticUpgrade clippy-debuginfoUpgrade rust-srcUpgrade rust-toolset-srpm-macrosUpgrade rust-docUpgrade cargoUpgrade rust-analyzer-debuginfoUpgrade rustfmt-debuginfoUpgrade rust-std-static-wasm32-wasip1Upgrade clippy | Jul 30, 2025 | Jul 5, 2025 |
| Debian | — | No solution exists | Jul 7, 2025 | Jul 5, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub