cve 2025 53605

CVE-2025-53605 is a denial-of-service vulnerability in the Rust protobuf crate, affecting versions prior to 3.7.2. The flaw allows uncontrolled recursion in CodedInputStream::skip_group when processing unknown fields from untrusted input, potentially leading to a stack overflow and DoS. The fix, introduced in version 3.7.2, adds depth checks and recursion accounting. Users of the Rust protobuf library should upgrade to 3.7.2 or later to mitigate the risk. This vulnerability is particularly relevant for developers and system administrators managing Rust-based software that parses untrusted protobuf data.