CVE-2025-53605: Rust Protobuf Uncontrolled Recursion Flaw

CVE-2025-53605 Overview

CVE-2025-53605 affects the protobuf crate for Rust before version 3.7.2. The vulnerability allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group function when parsing unknown fields in untrusted input. An attacker can craft a malicious Protocol Buffers message with deeply nested unknown group fields to trigger stack exhaustion. The flaw is tracked as [CWE-674: Uncontrolled Recursion] and disclosed under RustSec Security Advisory RUSTSEC-2024-0437. Applications parsing untrusted protobuf payloads with the affected crate are exposed to denial-of-service conditions.

Critical Impact
Remote attackers can crash Rust services that deserialize untrusted Protocol Buffers input by triggering stack overflow through recursive skip_group calls, resulting in denial of service.

Affected Products

Rust protobuf crate versions prior to 3.7.2
Rust applications and services deserializing untrusted Protocol Buffers input via the affected crate
Downstream libraries and binaries with a transitive dependency on vulnerable protobuf versions

Discovery Timeline

2025-07-05 - CVE-2025-53605 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53605

Vulnerability Analysis

The protobuf crate provides Protocol Buffers serialization and deserialization for Rust. The CodedInputStream::skip_group function skips over unknown group fields encountered during message parsing. When the parser encounters a nested group tag inside an unknown group, it recursively calls skip_group without enforcing a maximum recursion depth.

An attacker who controls the input stream can construct a message containing arbitrarily deep nesting of unknown group start tags. Each nested tag forces another recursive call on the thread stack. The recursion continues until the process exhausts its stack space, causing the thread to abort and terminating the parsing service.

This attack targets availability only. It does not corrupt memory, expose data, or enable code execution. Services that decode untrusted protobuf messages on network-facing threads face denial of service on each malformed payload.

Root Cause

The root cause is missing recursion depth limits in the unknown-field skip path of CodedInputStream. Well-known Protocol Buffers implementations enforce a maximum nesting depth, typically 100 levels, to bound stack usage. The affected protobuf crate versions did not enforce such a limit inside skip_group, so parser recursion scales linearly with attacker-controlled nesting.

Attack Vector

Exploitation requires only that the target application deserialize an attacker-supplied protobuf message. The attacker sends a payload containing repeated group start tags (wire type 3) without matching end tags, or nested inside further unknown groups. The parser dispatches into skip_group for each unknown tag, recursing deeper on every level.

The attack requires no authentication and no user interaction. It can be delivered over any transport carrying protobuf messages, including gRPC, HTTP APIs, message queues, and file uploads. The vulnerability manifests as a stack overflow abort in the parsing thread. See the GitHub Issue #749 Discussion and the Crates.io Protobuf Package for release details.

Detection Methods for CVE-2025-53605

Indicators of Compromise

Unexpected process aborts or thread panics in Rust services that decode Protocol Buffers input
Stack overflow signals (SIGSEGV, SIGABRT) originating from CodedInputStream::skip_group frames in crash dumps
Protobuf payloads containing abnormally deep nesting of unknown group tags (wire type 3)
Repeated malformed protobuf requests from a single source IP or client identifier

Detection Strategies

Inventory Rust builds with cargo tree or cargo audit to identify direct and transitive dependencies on protobuf versions prior to 3.7.2
Integrate cargo audit against the RustSec advisory database into CI pipelines to flag RUSTSEC-2024-0437
Instrument protobuf parsing code paths to log payload sizes and thread abort events for correlation

Monitoring Recommendations

Monitor application error telemetry for stack overflow crashes and abnormal restart rates on protobuf endpoints
Alert on spikes in request volume containing malformed or oversized protobuf payloads at API gateways
Track dependency drift across microservices to confirm all instances receive the patched crate version

How to Mitigate CVE-2025-53605

Immediate Actions Required

Upgrade the protobuf crate to version 3.7.2 or later across all Rust projects and rebuild affected binaries
Run cargo update -p protobuf and verify the resolved version with cargo tree before redeploying
Audit transitive dependencies using cargo audit and update parent crates that pin vulnerable protobuf versions
Restart long-running services to ensure patched code is loaded into memory

Patch Information

The maintainers fixed the recursion issue in protobuf 3.7.2, published to Crates.io. Details are tracked in GitHub Issue #749 and RUSTSEC-2024-0437. Update the crate version constraint in Cargo.toml and regenerate Cargo.lock to pull in the fixed release.

Workarounds

Reject protobuf messages exceeding a reasonable size threshold at the network boundary to reduce recursion depth
Isolate protobuf parsing in worker threads or processes that can be restarted without impacting the main service
Validate incoming protobuf schemas at an API gateway to drop messages containing unexpected unknown fields

bash

# Update the protobuf crate to the patched version
cargo update -p protobuf --precise 3.7.2

# Verify no vulnerable versions remain in the dependency tree
cargo tree -i protobuf

# Scan against the RustSec advisory database
cargo install cargo-audit
cargo audit