CVE-2025-53605:
The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.
CVE-2024-7254:
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
The package has not entered testing even though the delay is over
normal
The package has not entered testing even though the 20-day delay is over.Check why.
1 issue left for the package maintainer to handle:
CVE-2025-53605:
(needs triaging)
The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/r/rust-protobuf.png){kind=link}