~ / search / GHSA-p2gh-cfq4-4wjc

GHSA-p2gh-cfq4-4wjc

Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion

Source: GitHub Advisory Database (reviewed) High CVE-2026-6409

Packages

EcosystemPackageAffectedFixed in
Packagist google/protobuf < 4.33.6 4.33.6

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative `varint`s or deep recursion—can be used to crash the application, impacting service availability. ### Patches Patches have been released to 5.34.0-RC1 and 4.33.6.

References

External links from the advisory. They lead to third-party sites.