Executive brief
A denial-of-service vulnerability exists in the Google Protobuf PHP library, which is used for serializing and structured data exchange. An attacker can send specially crafted messages to crash applications using this library, leading to service outages and unavailability. This impact can disrupt business operations that rely on automated data processing or communication between services.
Technical details
A Denial of Service (DoS) vulnerability exists in the Google Protobuf PHP library (google/protobuf) due to improper handling of resource consumption during the parsing of untrusted input. Specifically, the library fails to safely process maliciously structured messages containing negative varints or deeply nested recursive structures. An unauthenticated remote attacker can exploit this by sending a crafted payload over the network, causing the PHP application to crash or consume excessive resources. This issue is tracked as CWE-400 (Uncontrolled Resource Consumption). Patches have been released in versions 4.33.6 and 5.34.0-RC1.
Affected products
- google protobuf < 4.33.6
Timeline
- 2026-03-23: disclosed: Vulnerability reported to protocolbuffers/protobuf repository.
- 2026-03-25: advisory: GitHub Advisory GHSA-p2gh-cfq4-4wjc published.
- 2026-03-25: patched: Fixes released in version 4.33.6.