Junglewise Threat Intelligence

CVE-2026-6409: Google Protobuf DoS via negative varints or deep recursion in PHP

CVE-2026-6409 · Severity: high · CVSS 4 · Published 2026-03-25

Technologies: google/protobuf (Packagist), Google Protobuf. Vendors: Packagist, Google.

Executive brief

A denial-of-service vulnerability exists in the Google Protobuf PHP library, which is used for serializing and structured data exchange. An attacker can send specially crafted messages to crash applications using this library, leading to service outages and unavailability. This impact can disrupt business operations that rely on automated data processing or communication between services.

Technical details

A Denial of Service (DoS) vulnerability exists in the Google Protobuf PHP library (google/protobuf) due to improper handling of resource consumption during the parsing of untrusted input. Specifically, the library fails to safely process maliciously structured messages containing negative varints or deeply nested recursive structures. An unauthenticated remote attacker can exploit this by sending a crafted payload over the network, causing the PHP application to crash or consume excessive resources. This issue is tracked as CWE-400 (Uncontrolled Resource Consumption). Patches have been released in versions 4.33.6 and 5.34.0-RC1.

Affected products

  • google protobuf < 4.33.6

Timeline

  • 2026-03-23: disclosed: Vulnerability reported to protocolbuffers/protobuf repository.
  • 2026-03-25: advisory: GitHub Advisory GHSA-p2gh-cfq4-4wjc published.
  • 2026-03-25: patched: Fixes released in version 4.33.6.

References

Related threats