googleapis / googleapis/python-aiplatform

protobuf 5.29.5 reported as vulnerable

Open
#5,451 0 comments 2 reactions 0 assignees View on GitHub
api: vertex-ai
Dominant language
Python
Stars
905
Forks
465
Avg merge
1d 13h
Merged PRs (30d)
44

Description

protobuf 5.29.5 reported as vulnerable

#### Environment details

- OS type and version: macos 15.5
- Python version: 3.12.2
- pip version: 25.0.1
- `google-cloud-aiplatform` version: Version: 1.71.1

#### Steps to reproduce

1. pip install vertexai==1.71.1
2. pip install google-generativeai==0.8.5
3. pip show protobuf (it will show 5.29.5) which is vulnerable.

Description
Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901

however vertexai library supports only upto 5.29.5.
one of my projcet has recived vulnerability issue because of this and cannot move ahead.

https://nvd.nist.gov/vuln/detail/CVE-2025-4565
it has CVSS-B [8.2 HIGH]

let me know if this will be updated soon.
Thanks

Thanks!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.