Junglewise Threat Intelligence

Google Protobuf PHP denial of service via malicious messages

Severity: high · CVSS 7.1 · Published 2026-04-16

Technologies: google/protobuf (Packagist). Vendors: Packagist, Google.

Executive brief

Google Protobuf is a library used to serialize and structure data for communication between different services. A vulnerability in the PHP version of this library allows an attacker to crash applications by sending specially crafted messages. This results in a denial-of-service, making the affected service unavailable to legitimate users.

Technical details

A Denial of Service (DoS) vulnerability exists in the Google Protobuf PHP library (both the Composer and PECL packages) due to improper input validation during the parsing of maliciously structured messages. Specifically, messages containing negative varints or excessive recursion depth can trigger an application crash. The attack can be carried out over the network without authentication, though it may require passive user interaction depending on the implementation. This issue is addressed in versions 4.33.6 and 5.34.0-RC1.

Affected products

  • Google protobuf-php < 4.33.6, < 5.34.0-RC1

Timeline

  • 2026-03-23: advisory: Original advisory GHSA-p2gh-cfq4-4wjc published
  • 2026-04-16: disclosed: CVE-2026-6409 published
  • 2026-04-16: patched: Fixes identified in versions 4.33.6 and 5.34.0-RC1

References

Related threats