PT-2026-30396 · Packagist · Google.Protobuf

Publicado 2026-03-25 · Atualizado 2026-03-25

OSV

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.

Patches

Patches have been released to 5.34.0-RC1 and 4.33.6.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

GHSA-P2GH-CFQ4-4WJC

Produtos afetados

Google.Protobuf

Referências · 8

• https://github.com/protocolbuffers/protobuf/issues/24159 · Nota
• https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-p2gh-cfq4-4wjc · Nota
• https://github.com/protocolbuffers/protobuf/issues/25067 · Nota
• https://github.com/protocolbuffers/protobuf/commit/c8e9b27d95c6ab2d0668b5889e7dac2c477b7038 · Nota
• https://github.com/protocolbuffers/protobuf · Nota
• https://github.com/protocolbuffers/protobuf/commit/60e93d2d104f2af9cd345b1c6f3891d91430244a · Nota
• https://osv.dev/vulnerability/GHSA-p2gh-cfq4-4wjc · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-6409 · Nota de Segurança