The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade clippyUpgrade rust-std-staticUpgrade rustUpgrade rust-debugger-commonUpgrade rust-docUpgrade rust-toolsetUpgrade cargoUpgrade rust-gdbUpgrade rust-srcUpgrade rustfmtUpgrade rust-toolset-srpm-macrosUpgrade rust-analyzer | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade rust-gdbUpgrade rust-analyzerUpgrade rust-toolsetUpgrade rust-lldbUpgrade cargo-debuginfoUpgrade rustfmtUpgrade clippy-debuginfoUpgrade rustUpgrade rust-debugsourceUpgrade rust-std-static-wasm32-unknown-unknownUpgrade rust-std-staticUpgrade rust-debugger-commonUpgrade rust-debuginfoUpgrade rustfmt-debuginfoUpgrade rust-std-static-wasm32-wasip1Upgrade rust-srcUpgrade rust-docUpgrade rust-analyzer-debuginfoUpgrade cargoUpgrade rust-toolset-srpm-macrosUpgrade clippy | Jul 30, 2025 | Jul 5, 2025 |
| Debian | — | No solution exists | Jul 7, 2025 | Jul 5, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub