Uncontrolled Recursion in protobuf - CVE-2025-4565

Vulnerability identifier: #VU112882

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-4565

CWE-ID: CWE-674

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

the vulnerability exists due to uncontrolled recursion when parsing untrusted data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags. A remote attacker send specially crafted input to the application and can perform a denial of service attack. 

protobuf
watsonx Orchestrate Developer Edition
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Maximo Application Suite Ai Service
IBM Security QRadar Network Threat Analytics
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Public Cloud Module
SUSE Package Hub 15
Basesystem Module
Ubuntu
openEuler
Anolis OS
Netcool Operations Insight
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
Ansible Automation Platform
Splunk Enterprise
IBM API Connect
python3.11-galaxy-importer (Red Hat package)
automation-eda-controller (Red Hat package)
receptor (Red Hat package)
python3.11-botocore (Red Hat package)
protobuf (Ubuntu package)
python3.11-urllib3 (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
automation-platform-ui (Red Hat package)
python3.11-django-ansible-base (Red Hat package)
automation-gateway (Red Hat package)
ansible-core (Red Hat package)
python3.11-requests (Red Hat package)
python3-protobuf
libprotobuf20
libprotobuf20-debuginfo
libprotobuf-lite20
libprotobuf-lite20-debuginfo
protobuf-debugsource
libprotoc20
libprotoc20-debuginfo
protobuf-devel
protobuf-lite
protobuf-lite-devel
protobuf-bom
protobuf-debuginfo
protobuf-compiler
protobuf
protobuf-java
protobuf-java-util
protobuf-javadoc
protobuf-javalite
protobuf-parent
protobuf-vim
protobuf-emacs
protobuf-doc
protobuf-static
protobuf-lite-static
python3.11-pulpcore (Red Hat package)
python3.11-django (Red Hat package)
python-django (Red Hat package)
automation-controller (Red Hat package)
automation-hub (Red Hat package)
python3.11-galaxy-ng (Red Hat package)
python3.11-protobuf (Red Hat package)
ansible-dev-tools (Red Hat package)
ansible-lint (Red Hat package)
ansible-navigator (Red Hat package)
Red Hat OpenShift Container Platform

Install updates from vendor's website.

protobuf - addressed in versions 4.25.8, 5.29.5, 6.31.1
Netcool Operations Insight - update to 1.6.15
watsonx Orchestrate Developer Edition - update to 1.13.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.2
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2.1
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 5.2
Splunk Enterprise - addressed in versions 9.3.10, 9.4.9, 10.0.4, 10.2.1
Maximo Application Suite Ai Service - update to 9.1.1
IBM API Connect - update to 10.0.8.5
python3.11-galaxy-importer (Red Hat package) - update to 0.4.37-2.el9ap
automation-eda-controller (Red Hat package) - update to 1.2.4-1.el9ap
IBM Security QRadar Network Threat Analytics - update to 1.4.0
receptor (Red Hat package) - addressed in versions 1.6.3-2.el9ap, 1.6.3-2.el10ap
python3.11-botocore (Red Hat package) - update to 1.34.162-1.el9ap
Ansible Automation Platform - update to 2.6
protobuf (Ubuntu package) - addressed in versions 2.6.1-1.3ubuntu0.1~esm4, 3.0.0-9.1ubuntu1.1+esm3, 3.6.1.3-2ubuntu5.2+esm2, 3.12.4-1ubuntu7.22.04.4, 3.21.12-8.2ubuntu0.2, 3.21.12-10ubuntu0.1
python3.11-urllib3 (Red Hat package) - update to 2.6.3-1.el9ap
ansible-automation-platform-installer (Red Hat package) - update to 2.6-4.el9ap
automation-platform-ui (Red Hat package) - update to 2.6.5-1.el9ap
python3.11-django-ansible-base (Red Hat package) - update to 2.6.20260121-1.el9ap
automation-gateway (Red Hat package) - update to 2.6.20260121-1.el9ap
ansible-core (Red Hat package) - addressed in versions 2.16.15-1.el9ap, 2.16.15-2.el10ap
python3.11-requests (Red Hat package) - update to 2.31.0-3.el9ap
python3-protobuf - addressed in versions 3.9.2-150200.4.27.1, 3.9.2-150200.4.33.1
libprotobuf20 - addressed in versions 3.9.2-150200.4.27.1, 3.9.2-150200.4.33.1
libprotobuf20-debuginfo - addressed in versions 3.9.2-150200.4.27.1, 3.9.2-150200.4.33.1
libprotobuf-lite20 - addressed in versions 3.9.2-150200.4.27.1, 3.9.2-150200.4.33.1
libprotobuf-lite20-debuginfo - addressed in versions 3.9.2-150200.4.27.1, 3.9.2-150200.4.33.1
protobuf-debugsource - addressed in versions 3.9.2-150200.4.27.1, 3.9.2-150200.4.33.1
libprotoc20 - update to 3.9.2-150200.4.33.1
libprotoc20-debuginfo - update to 3.9.2-150200.4.33.1
protobuf-devel - addressed in versions 3.14.0-8, 3.14.0-9, 25.1-9, 25.1-11
protobuf-lite - addressed in versions 3.14.0-8, 3.14.0-9, 25.1-9, 25.1-11
protobuf-lite-devel - addressed in versions 3.14.0-8, 3.14.0-9, 25.1-9, 25.1-11
protobuf-bom - addressed in versions 3.14.0-8, 3.14.0-9, 25.1-9, 25.1-11
protobuf-debugsource - addressed in versions 3.14.0-8, 3.14.0-9, 25.1-9, 25.1-11
protobuf-debuginfo - addressed in versions 3.14.0-8, 3.14.0-9, 25.1-9, 25.1-11
protobuf-compiler - addressed in versions 3.14.0-8, 3.14.0-9, 25.1-9, 25.1-11
protobuf - addressed in versions 3.14.0-8, 3.14.0-9, 25.1-9, 25.1-11
protobuf-java - addressed in versions 3.14.0-8, 3.14.0-9, 25.1-9, 25.1-11
protobuf-java-util - addressed in versions 3.14.0-8, 3.14.0-9, 25.1-9, 25.1-11
protobuf-javadoc - addressed in versions 3.14.0-8, 3.14.0-9, 25.1-9, 25.1-11
protobuf-javalite - addressed in versions 3.14.0-8, 3.14.0-9, 25.1-9, 25.1-11
protobuf-parent - addressed in versions 3.14.0-8, 3.14.0-9, 25.1-9, 25.1-11
python3-protobuf - addressed in versions 3.14.0-8, 3.14.0-9, 25.1-9, 25.1-11
python3-protobuf - update to 3.19.6-7
protobuf-lite-devel - update to 3.19.6-7
protobuf-vim - update to 3.19.6-7
protobuf-emacs - update to 3.19.6-7
protobuf-doc - update to 3.19.6-7
protobuf-static - update to 3.19.6-7
protobuf-lite-static - update to 3.19.6-7
protobuf - update to 3.19.6-7
protobuf-compiler - update to 3.19.6-7
protobuf-devel - update to 3.19.6-7
protobuf-lite - update to 3.19.6-7
python3.11-pulpcore (Red Hat package) - update to 3.49.49-1.el9ap
python3.11-django (Red Hat package) - update to 4.2.27-2.el9ap
python-django (Red Hat package) - update to 4.2.27-2.el10ap
automation-controller (Red Hat package) - update to 4.7.8-1.el9ap
automation-hub (Red Hat package) - update to 4.11.5-1.el9ap
python3.11-galaxy-ng (Red Hat package) - update to 4.11.5-1.el9ap
Red Hat OpenShift Container Platform - update to 4.19.4
python3.11-protobuf (Red Hat package) - update to 4.25.8-1.el9ap
ansible-dev-tools (Red Hat package) - addressed in versions 26.1.0-2.el9ap, 26.1.0-2.el10ap
ansible-lint (Red Hat package) - addressed in versions 26.1.0-2.el9ap, 26.1.0-2.el10ap
ansible-navigator (Red Hat package) - addressed in versions 26.1.1-2.el9ap, 26.1.1-2.el10ap

• https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901
• https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8qvm-5x2c-j2w7

• Denial of service in Protobuf
• openEuler 22.03 LTS SP4 update for protobuf
• openEuler 22.03 LTS SP3 update for protobuf
• openEuler 24.03 LTS update for protobuf
• openEuler 20.03 LTS SP4 update for protobuf
• openEuler 24.03 LTS SP2 update for protobuf
• openEuler 24.03 LTS SP1 update for protobuf
• Ubuntu update for protobuf
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in IBM Security QRadar Network Threat Analytics
• IBM Maximo AI Service update for Protobuf Pure-Python
• Anolis OS update for protobuf
• Anolis OS update for protobuf
• Ubuntu update for protobuf
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for Protobuf Pure-Python
• SUSE update for protobuf
• IBM watsonx Orchestrate Developer Edition update for protobuf
• IBM Watson Speech Services Cartridge update for protobuf
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM API Connect
• Multiple vulnerabilities in Ansible Automation Platform 2.6 packages
• Multiple vulnerabilities in Splunk Enterprise
• SUSE update for protobuf
• Multiple vulnerabilities in IBM Watson Knowledge Catalog on-prem