PT-2026-30396 · Packagist · Google.Protobuf

Published 2026-03-25 · Updated 2026-03-25

OSV

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.

Patches

Patches have been released to 5.34.0-RC1 and 4.33.6.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

GHSA-P2GH-CFQ4-4WJC

Affected Products

Google.Protobuf

References · 8

• https://osv.dev/vulnerability/GHSA-p2gh-cfq4-4wjc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6409 · Security Note
• https://github.com/protocolbuffers/protobuf/issues/24159 · Note
• https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-p2gh-cfq4-4wjc · Note
• https://github.com/protocolbuffers/protobuf/issues/25067 · Note
• https://github.com/protocolbuffers/protobuf/commit/c8e9b27d95c6ab2d0668b5889e7dac2c477b7038 · Note
• https://github.com/protocolbuffers/protobuf · Note
• https://github.com/protocolbuffers/protobuf/commit/60e93d2d104f2af9cd345b1c6f3891d91430244a · Note