Protobuf DoS

[DarkaMaul]

This (public) advisory follows two emails sent on August 9 and October 3rd.

The crate is affected by the same vulnerability as described in GHSA-735f-pc8j-v9w8

[jayvdb]

ping @stepancheg

[tnull]

The crate is affected by the same vulnerability as described in GHSA-735f-pc8j-v9w8

Given that this affects multiple implementations across different languages, do we know whether other Rust protobuf implementations such as prost might also be affected?

[DarkaMaul]

The crate is affected by the same vulnerability as described in GHSA-735f-pc8j-v9w8

Given that this affects multiple implementations across different languages, do we know whether other Rust protobuf implementations such as prost might also be affected?

From my understanding, prost is not affected by the same issue:

• it does not support unknown fields ( Add support for unknown fields tokio-rs/prost#2 )
• it performs a recursion depth limit check when parsing unknown fields

[tnull]

From my understanding, prost is not affected by the same issue:

• it does not support unknown fields
• it performs a recursion depth limit check when parsing unknown fields

That makes sense. Thank you for clarifying!