diff --git a/.changeset/bump-protobuf-javalite.md b/.changeset/bump-protobuf-javalite.md
new file mode 100644
index 000000000..919bb568b
--- /dev/null
+++ b/.changeset/bump-protobuf-javalite.md
@@ -0,0 +1,5 @@
+---
+"client-sdk-android": patch
+---
+
+Bumped protobuf-javalite to 3.25.9, which fixes the unbounded parser recursion reported as CVE-2024-7254.
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 6c3caf7b0..13b1d2666 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -22,7 +22,7 @@ lint = "30.0.1"
 okhttp = "4.12.0"
 preferenceKtx = "1.2.1"
 protobuf = "3.22.0"
-protobufJavalite = "3.22.0"
+protobufJavalite = "3.25.9"
 segmentationSelfie = "16.0.0-beta6"
 semver4j = "3.1.0"
 appcompat = "1.6.1"