In STM32, IO pins are usually in two groups: those, which are 5V-tolerant (marked in the pin table in datasheet as FT), and those which are not (TT). There are also a few special pins such as NRST; and the two major groups have also sub-variants, marked by additional small letters, e.g. FTa for 5V-tolerant pin with additional analog functionality.

TT pins simply have protection diodes to both VDD and GND (=VSS). FT pins don't have the protection diode to VDD, and that allows external voltages higher than VDD (i.e. +5V} to be connected to FT pins.

However, there are several limitations to this:

• Even if there is no diode directly from FT pin to VDD, there is an ESD protection structure connected, which limits the maximum FT input voltage to VDD+4.0V (as if it would be a reverse polarized Zener diode in series with another diode preventing current flow from VDD to pin - the actual circuit is different and uses a relatively complex structure pantented by ST). Exceeding this limit may damage the pin or the entire chip.
  As VDD is typically min 1.8V and 1.8V+4.0V=5.8V, it may appear that there's enough headroom for 5V signals. However, if the chip is powered down, VDD=0V, so connecting a 5V signal to an FT pin of unpowered STM32 may result in damaged chip.
• If FT pin is set as push-pull output (including AF set by peripheral to output), or pullup is switched on, there will be a flow of current ("injection") from pin to VDD. The amount of current depends on resistances in the entire path, so they must be set so that the current won't exceed the pin's injection limit (usually a few mA). Also, power supplies are usually not designed to handle reverse current flow, so in case of excessive current the VDD rail may rise above expected levels and cause damage to STM32 and/or any other circuit connected to the same power supply.
• FT pins which have also analog functionality (FTa) become usually non-5V-tolerant, if their analog functionality is switched on. This is usually accomplished by setting given pin to Analog in its respective GPIOx_MODER, although in certain models there may be additional switches, which isolate the analog function from the pin itself.
  Note, that some STM32 families have almost all pins set to Analog by default. Unfortunately, the documentation is often vague in explaining what are exactly the conditions for such pins to be 5V-tolerant; so unless documented otherwise, the failproof method is to switch on any external circuitry which would set voltage on FT pins above VDD should be accomplished only after all such pins have been properly set to some of the non-Analog setting in GPIOx_MODER.

There may be additional limits to certain pins, and also values mentioned above may not be valid for all STM32 models, so always consult the datasheet to your particular STM32 model.