It was discovered that Protocol Buffers did not properly handle negative varint lengths or enforce recursion limits when parsing input in the PHP library. An attacker could possibly use this issue to cause applications using Protocol Buffers to crash or consume resources, resulting in a denial of service.

Read the full article at Ubuntu Security →