AIKIDO-2026-872542
google-protobuf is vulnerable to Denial of Service (DoS)
55
Medium Risk
This Affects:
google-protobufTL;DR
The Ruby C extension's Message_decode_bytes function takes the encoded payload size as a signed 32-bit int, so decoding an untrusted serialized message of 2 GB or larger truncates the size value before it reaches the parser. This lets an oversized payload passed to Message.decode crash the Ruby process instead of failing with a normal parse error. The fix widens the size parameter to size_t and raises a Google::Protobuf::ParseError for oversized input instead of crashing.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you decode protobuf messages larger than 2 GB from untrusted sources.
Background info
google-protobuf is vulnerable to Denial of Service (DoS) in versions 3.25.1 - 4.34.2.
How to fix this
Upgrade the google-protobuf library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.