{"action":"Upgrade protobuf to 4.25.8 or later.","affected":[{"fixed":"4.25.8","introduced":"0"},{"fixed":"5.29.5","introduced":"5.26.0rc1"},{"fixed":"6.31.1","introduced":"6.30.0rc1"}],"component":"protobuf","cve_ids":["CVE-2025-4565"],"ecosystem":"PyPI","epss":0.00255,"exploited":false,"fixed_versions":["4.25.8","5.29.5","6.31.1"],"ghsa_id":"GHSA-8qvm-5x2c-j2w7","id":"tcs_01M5KGVSW3E1S7MW0WFV9D4HH9","modified_at":"2026-07-07T17:48:07.186137733Z","published_at":"2026-07-07T16:02:55.431384Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1806","https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8","https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8qvm-5x2c-j2w7","https://nvd.nist.gov/vuln/detail/CVE-2025-4565","https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901","https://github.com/protocolbuffers/protobuf","https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/decoder_test.py#L87-L98","https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/message_test.py#L1436-L1478","https://github.com/protocolbuffers/protobuf/tree/main/python#implementation-backends","https://pypi.org/project/protobuf","https://github.com/advisories/GHSA-8qvm-5x2c-j2w7"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-1806","url":"https://osv.dev/vulnerability/PYSEC-2026-1806"},{"source":"nvd","source_id":"CVE-2025-4565","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4565"}],"summary":"protobuf-python has a potential Denial of Service issue"}