What is GHSA-p2gh-cfq4-4wjc?

GHSA-p2gh-cfq4-4wjc is a security advisory published by GitHub Security Advisories with High severity. Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion

Which CVE IDs does GHSA-p2gh-cfq4-4wjc cover?

GHSA-p2gh-cfq4-4wjc covers the following CVE IDs: CVE-2026-6409. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-p2gh-cfq4-4wjc?

GHSA-p2gh-cfq4-4wjc affects 1 product, including: composer/google/protobuf:\u003c 4.33.6.

GHSA-p2gh-cfq4-4wjcHigh

Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion

Vendor

GitHub Security Advisories

Published

March 25, 2026

Last Modified

April 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-6409 →

📋 Description

Impact

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.

Patches

Patches have been released to 5.34.0-RC1 and 4.33.6.

🎯 Affected products1

composer/google/protobuf:< 4.33.6

🔗 References (7)

https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-p2gh-cfq4-4wjc
https://github.com/protocolbuffers/protobuf/issues/24159
https://github.com/protocolbuffers/protobuf/issues/25067
https://github.com/protocolbuffers/protobuf/commit/60e93d2d104f2af9cd345b1c6f3891d91430244a
https://github.com/protocolbuffers/protobuf/commit/c8e9b27d95c6ab2d0668b5889e7dac2c477b7038
https://nvd.nist.gov/vuln/detail/CVE-2026-6409
https://github.com/advisories/GHSA-p2gh-cfq4-4wjc