The Rust ecosystem’s widely used protobuf crate contains a denial‑of‑service flaw: CVE‑2025‑53605 affects versions before 3.7.2 and permits uncontrolled recursion in protobuf::coded_input_stream::CodedInputStream::skip_group when processing unknown fields from untrusted input. The maintainers...
CVE-2022-3509 is a parsing bug in Google’s Protocol Buffers Java implementation that can be triggered by crafted text‑format messages to force excessive object churn and long JVM garbage‑collection pauses, producing a denial‑of‑service (DoS) condition in vulnerable applications; operators should...