CVE-2026-6409
CVE-2026-6409 · Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
CVSS 7.1 · High · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
protobuf-php (pecl)
- Versions
- ≥ 0, < 5.34.0-RC1: Affected (semver)
- ≥ 0, < 4.33.6: Affected (semver)
Update to 4.33.6
protobuf Debian:12
- Versions
- 3.21.12-3
- Affected ranges
- ECOSYSTEM: < 3.21.12-3+deb12u1
Update to 3.21.12-3+deb12u1
protobuf Debian:13
- Versions
- 3.21.12-11
- Affected ranges
- ECOSYSTEM: < 3.21.12-11+deb13u1
Update to 3.21.12-11+deb13u1
protobuf Debian:14
- Versions
- 3.21.12-11
- 3.21.12-12
- 3.21.12-13
- 3.21.12-14
- 3.21.12-15
- Affected ranges
- ECOSYSTEM: < 3.21.12-16
Update to 3.21.12-16
google/protobuf Packagist
- Versions
- v3.1.0-alpha-1
- v3.10.0
- v3.10.0RC1
- v3.11.0
- v3.11.0RC1
- v3.11.0RC2
- v3.11.1
- v3.11.2
- v3.11.3
- v3.11.4
- v3.12.0
- v3.12.0RC1
- v3.12.0RC2
- v3.12.1
- v3.12.2
- v3.12.4
- v3.13.0
- v3.13.0.1
- v3.13.0RC3
- v3.14.0
- v3.14.0RC1
- v3.14.0RC2
- v3.14.0RC3
- v3.15.0
- v3.15.0RC1
- v3.15.0RC2
- v3.15.1
- v3.15.2
- v3.15.3
- v3.15.4
- v3.15.5
- v3.15.6
- v3.15.7
- v3.15.8
- v3.16.0
- v3.16.0RC1
- v3.16.0RC2
- v3.17.0
- v3.17.0RC1
- v3.17.0RC2
- v3.17.1
- v3.17.2
- v3.17.3
- v3.18.0
- v3.18.0RC1
- v3.18.0RC2
- v3.18.1
- v3.18.2
- v3.18.3
- v3.19.0
- v3.19.0RC1
- v3.19.0RC2
- v3.19.1
- v3.19.2
- v3.19.3
- v3.19.4
- v3.19.5
- v3.19.6
- v3.2.0-alpha-1
- v3.20.0RC1
- v3.20.0RC2
- v3.20.1
- v3.20.1RC1
- v3.20.2
- v3.20.3
- v3.21.0
- v3.21.0RC1
- v3.21.0RC2
- v3.21.1
- v3.21.10
- v3.21.11
- v3.21.12
- v3.21.2
- v3.21.3
- v3.21.4
- v3.21.5
- v3.21.6
- v3.21.7
- v3.21.8
- v3.21.9
- v3.22.0
- v3.22.0RC3
- v3.22.1
- v3.22.2
- v3.22.3
- v3.22.4
- v3.22.5
- v3.23.0
- v3.23.0RC1
- v3.23.0RC2
- v3.23.0RC3
- v3.23.1
- v3.23.2
- v3.23.3
- v3.23.4
- v3.24.0
- v3.24.0RC1
- v3.24.0RC2
- v3.24.0RC3
- v3.24.1
- v3.24.2
- v3.24.3
- v3.24.4
- v3.25.0
- v3.25.0RC1
- v3.25.0RC2
- v3.25.1
- v3.25.2
- v3.25.3
- v3.25.4
- v3.25.5
- v3.25.6
- v3.25.7
- v3.25.8
- v3.25.9
- v3.3.0
- v3.3.0rc1
- v3.3.1
- v3.3.2
- v3.4.0
- v3.4.0rc1
- v3.4.0rc2
- v3.4.0rc3
- v3.4.1
- v3.5.0
- v3.5.0.1
- v3.5.1
- v3.5.1.1
- v3.5.2
- v3.6.0
- v3.6.0.1
- v3.6.0rc1
- v3.6.0rc2
- v3.6.1
- v3.6.1.1
- v3.6.1.2
- v3.6.1.3
- v3.7.0
- v3.7.0-rc.3
- v3.7.0rc1
- v3.7.0rc2
- v3.7.1
- v3.8.0
- v3.8.0RC1
- v3.9.0
- v3.9.0RC1
- v3.9.1
- v3.9.2
- v4.0.0RC1
- v4.0.0RC2
- v4.26.0
- v4.26.0RC1
- v4.26.0RC2
- v4.26.0RC3
- v4.26.1
- v4.27.0
- v4.27.0RC1
- v4.27.0RC2
- v4.27.0RC3
- v4.27.1
- v4.27.2
- v4.27.3
- v4.27.4
- v4.27.5
- v4.28.0
- v4.28.0RC1
- v4.28.0RC2
- v4.28.0RC3
- v4.28.1
- v4.28.2
- v4.28.3
- v4.29.0
- v4.29.0RC1
- v4.29.0RC2
- v4.29.0RC3
- v4.29.1
- v4.29.2
- v4.29.3
- v4.29.4
- v4.29.5
- v4.29.6
- v4.30.0
- v4.30.0RC1
- v4.30.0RC2
- v4.30.1
- v4.30.2
- v4.31.0
- v4.31.0RC1
- v4.31.0RC2
- v4.31.1
- v4.32.0
- v4.32.0RC1
- v4.32.0RC2
- v4.32.1
- v4.33.0
- v4.33.0RC1
- v4.33.0RC2
- v4.33.1
- v4.33.2
- v4.33.3
- v4.33.4
- v4.33.5
- Affected ranges
- ECOSYSTEM: < 4.33.6
Update to 4.33.6
protobuf Ubuntu:24.04:LTS
- Versions
- 3.21.12-7ubuntu1
- 3.21.12-8ubuntu1
- 3.21.12-8ubuntu5
- 3.21.12-8.2
- 3.21.12-8.2build1
- 3.21.12-8.2ubuntu0.1
- 3.21.12-8.2ubuntu0.2
- 3.21.12-8.2ubuntu0.3
- 3.21.12-8.2ubuntu0.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
protobuf Ubuntu:25.10
- Versions
- 3.21.12-10build2
- 3.21.12-11
- 3.21.12-11ubuntu1
- 3.21.12-11ubuntu3
- 3.21.12-11ubuntu3.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
protobuf Ubuntu:26.04:LTS
- Versions
- 3.21.12-11ubuntu3
- 3.21.12-14
- 3.21.12-14build1
- 3.21.12-15
- 3.21.12-15ubuntu1
- 3.21.12-15ubuntu1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published