AIKIDO-2026-872542
google-protobuf is vulnerable to Denial of Service (DoS)
55
CVE Score
Medium
Denial of Service (DoS)
TL;DR
The Ruby C extension's Message_decode_bytes function takes the encoded payload size as a signed 32-bit int, so decoding an untrusted serialized message of 2 GB or larger truncates the size value before it reaches the parser. This lets an oversized payload passed to Message.decode crash the Ruby process instead of failing with a normal parse error. The fix widens the size parameter to size_t and raises a Google::Protobuf::ParseError for oversized input instead of crashing.
How do I fix this?
Upgrade the google-protobuf library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you decode protobuf messages larger than 2 GB from untrusted sources.
Package
Versions
3.25.1 - 4.34.2
Fixed in 4.35.0Background info
google-protobuf is vulnerable to Denial of Service (DoS) in versions 3.25.1 - 4.34.2.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.