Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 7.1, published 16 April 2026.

Which products and versions are affected?

google/protobuf (Packagist) < 4.33.6.

Is there a fix for This vulnerability?

A patch was published on 2026-04-16: Fixes identified in versions 4.33.6 and 5.34.0-RC1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Google Protocol Buffers or google/protobuf (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Google Protobuf PHP denial of service via malicious messages

Q: Is there a fix for This vulnerability?

A patch was published on 2026-04-16: Fixes identified in versions 4.33.6 and 5.34.0-RC1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run Google Protocol Buffers or google/protobuf (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 7.1 · Published 2026-04-16

Google Protobuf is a library used to serialize and structure data for communication between different services. A vulnerability in the PHP version of this library allows an attacker to crash applications by sending specially crafted messages. This results in a denial-of-service, making the affected service unavailable to legitimate users.

Technologies: google/protobuf (Packagist). Vendors: Google, Packagist.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 7.1, published 16 April 2026.
Which products and versions are affected?: google/protobuf (Packagist) < 4.33.6.
Is there a fix for This vulnerability?: A patch was published on 2026-04-16: Fixes identified in versions 4.33.6 and 5.34.0-RC1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Google Protocol Buffers or google/protobuf (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Denial of Service (DoS) vulnerability exists in the Google Protobuf PHP library (both the Composer and PECL packages) due to improper input validation during the parsing of maliciously structured messages. Specifically, messages containing negative varints or excessive recursion depth can trigger an application crash. The attack can be carried out over the network without authentication, though it may require passive user interaction depending on the implementation. This issue is addressed in versions 4.33.6 and 5.34.0-RC1.

Affected products

Google protobuf-php < 4.33.6, < 5.34.0-RC1

Timeline

2026-03-23: advisory: Original advisory GHSA-p2gh-cfq4-4wjc published
2026-04-16: disclosed: CVE-2026-6409 published
2026-04-16: patched: Fixes identified in versions 4.33.6 and 5.34.0-RC1

References

https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-p2gh-cfq4-4wjc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.