protobuf Crate Uncontrolled Recursion Vulnerability in Rust

A denial-of-service vulnerability has been identified in the protobuf crate for Rust, affecting versions through 3.4.0. The issue arises in the 'skip_group' function of the 'CodedInputStream' module, where improper parsing of unknown fields in untrusted input can lead to uncontrolled recursion. This flaw allows attackers to cause a stack overflow by exploiting the recursive parsing of messages.

Impact

Exploitation of this vulnerability leads to a stack overflow, causing a crash due to uncontrolled recursion.

Remediation

Users can upgrade to version 3.7.2 or later to address this vulnerability.