# Ubuntu fixes Protocol Buffers DoS flaws in PHP library

> **Key takeaway:** Ubuntu patched two denial-of-service vulnerabilities in Protocol Buffers' PHP library affecting 24.04 LTS and 26.04 LTS.

**Published:** 2026-10-20T14:49:32+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-fixes-protocol-buffers-dos-flaws-in-php-library.html 

## Summary
Ubuntu published USN-8943-1 to address CVE-2026-6409 in the php-google-protobuf package. The flaws involve improper handling of negative varint lengths and missing recursion limits during parsing, which could crash applications or exhaust resources. Patched versions are available for Ubuntu 24.04 LTS (noble) and 26.04 LTS (resolute).

## What the Protocol Buffers patches fix
- **Negative varint lengths**: The PHP parser failed to properly validate varint length values, allowing malformed input to trigger unexpected behavior.
- **Missing recursion limits**: Without enforced recursion depth limits during message parsing, deeply nested or maliciously crafted payloads could exhaust stack or heap resources.
- **Attack vector**: Specially crafted Protocol Buffers input sent to PHP applications using the library.
- **Impact**: Application crashes or resource consumption leading to denial of service.
- **Affected package**: `php-google-protobuf` versions prior to `3.21.12-8.2ubuntu0.4` (24.04) and `3.21.12-15ubuntu1.1` (26.04).

## Why it matters
PHP deployments using Protocol Buffers for data serialization—common in microservices and API backends—should prioritize this update to prevent trivial DoS attacks via malformed payloads.