GHSA-qjfj-3mm5-vrjg

Suggest an improvement
Source
https://github.com/advisories/GHSA-qjfj-3mm5-vrjg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-qjfj-3mm5-vrjg/GHSA-qjfj-3mm5-vrjg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qjfj-3mm5-vrjg
Withdrawn
2026-04-16T22:59:19Z
Published
2026-04-16T15:31:33Z
Modified
2026-09-10T03:51:02Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
Withdrawn Advisory: Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-p2gh-cfq4-4wjc. This link is maintained to preserve external references.

Original Description

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.

Database specific 
{
    "cwe_ids":  [
        "CWE-20"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-16T22:59:19Z",
    "nvd_published_at":  "2026-04-16T15:17:41Z",
    "severity":  "HIGH"
}
References

Affected packages

Packagist / google/protobuf

Package

Name
google/protobuf
Purl
pkg:composer/google/protobuf

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

v3.*
v3.1.0-alpha-1
v3.2.0-alpha-1
v3.3.0rc1
v3.3.0
v3.3.1
v3.3.2
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.0
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0rc1
v3.6.0rc2
v3.6.0
v3.6.0.1
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0rc1
v3.7.0rc2
v3.7.0-rc.3
v3.7.0
v3.7.1
v3.8.0RC1
v3.8.0
v3.9.0RC1
v3.9.0
v3.9.1
v3.9.2
v3.10.0RC1
v3.10.0
v3.11.0RC1
v3.11.0RC2
v3.11.0
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0RC1
v3.12.0RC2
v3.12.0
v3.12.1
v3.12.2
v3.12.4
v3.13.0RC3
v3.13.0
v3.13.0.1
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.14.0
v3.15.0RC1
v3.15.0RC2
v3.15.0
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0RC1
v3.16.0RC2
v3.16.0
v3.17.0RC1
v3.17.0RC2
v3.17.0
v3.17.1
v3.17.2
v3.17.3
v3.18.0RC1
v3.18.0RC2
v3.18.0
v3.18.1
v3.18.2
v3.18.3
v3.19.0RC1
v3.19.0RC2
v3.19.0
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.20.0RC1
v3.20.0RC2
v3.20.1RC1
v3.20.1
v3.20.2
v3.20.3
v3.21.0RC1
v3.21.0RC2
v3.21.0
v3.21.1
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.21.10
v3.21.11
v3.21.12
v3.22.0RC3
v3.22.0
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.0
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.0
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0RC1
v3.25.0RC2
v3.25.0
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v4.*
v4.0.0RC1
v4.0.0RC2
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.0
v4.26.1
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.0
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.0
v4.28.1
v4.28.2
v4.28.3
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.0
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0RC1
v4.30.0RC2
v4.30.0
v4.30.1
v4.30.2
v4.31.0RC1
v4.31.0RC2
v4.31.0
v4.31.1
v4.32.0RC1
v4.32.0RC2
v4.32.0
v4.32.1
v4.33.0RC1
v4.33.0RC2
v4.33.0
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
v4.33.6
v5.*
v5.34.0RC1
v5.34.0RC2
v5.34.0
v5.34.1
v5.34.2
v5.35.0RC1
v5.35.0RC2
v5.35.0
v5.35.1
v5.36.0RC1
v5.36.0RC2
v5.36.0
v5.36.1

Database specific

last_known_affected_version_range 
"< 4.33.6"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-qjfj-3mm5-vrjg/GHSA-qjfj-3mm5-vrjg.json"