CVE-2026-6409
Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
- Record
CVE-2026-6409- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2026-23268
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
- Record
EUVD-2026-23268- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p2gh-cfq4-4wjc
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
Impact
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
Patches
Patches have been released to 5.34.0-RC1 and 4.33.6.
- Record
GHSA-p2gh-cfq4-4wjc- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
- Record
CVE-2026-6409- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
- Record
CVE-2026-6409- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-6409
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
- Record
DEBIAN-CVE-2026-6409- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-p2gh-cfq4-4wjc
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
Impact
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
Patches
Patches have been released to 5.34.0-RC1 and 4.33.6.
- Record
GHSA-p2gh-cfq4-4wjc- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-6409
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
- Record
UBUNTU-CVE-2026-6409- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVAZL-83420 No score
CVE-2026-6409 affecting package protobuf for versions less than 25.3-7
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
- Record
AZL-83420- Updated
- 2026-11-05
OSVCLSA-2026-1778633123 No score
TuxCare security update for google/protobuf (1 CVE)
TuxCare rebuilt google/protobuf to address 1 CVE. Fixed in 3.24.4-p1+tuxcare.
- Record
CLSA-2026-1778633123- Updated
- 2026-11-02
OSVCLSA-2026-1787916992 No score
TuxCare security update for google/protobuf (1 CVE)
TuxCare rebuilt google/protobuf to address 1 CVE. Fixed in 3.25.9-p1+tuxcare.
- Record
CLSA-2026-1787916992- Updated
- 2026-11-02
OSVUSN-8943-1 No score
protobuf vulnerability
It was discovered that Protocol Buffers did not properly handle negative varint lengths or enforce recursion limits when parsing input in the PHP library. An attacker could possibly use this issue to cause applications using Protocol Buffers to crash or consume resources, resulting in a denial of service.
- Record
USN-8943-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
google/protobufPackagist |
before 4.33.6 | 4.33.6 |
protobufAzure Linux:3 |
before 25.3-7 | 25.3-7 |
google/protobufTuxCare:Packagist |
3.24.4 up to 3.24.4-p1+tuxcare | 3.24.4-p1+tuxcare |
google/protobufTuxCare:Packagist |
3.25.9 up to 3.25.9-p1+tuxcare | 3.25.9-p1+tuxcare |
protobufDebian:12 |
before 3.21.12-3+deb12u1, plus listed versions 3.21.12-3 |
3.21.12-3+deb12u1 |
protobufDebian:13 |
before 3.21.12-11+deb13u1, plus listed versions 3.21.12-11 |
3.21.12-11+deb13u1 |
protobufDebian:14 |
before 3.21.12-16, plus listed versions 3.21.12-113.21.12-123.21.12-133.21.12-143.21.12-15 |
3.21.12-16 |
google/protobufPackagist |
before 4.33.6, plus listed versions v3.1.0-alpha-1v3.10.0v3.10.0RC1v3.11.0v3.11.0RC1 Show 45 moreShow lessv3.11.0RC2v3.11.1v3.11.2v3.11.3v3.11.4v3.12.0v3.12.0RC1v3.12.0RC2v3.12.1v3.12.2v3.12.4v3.13.0v3.13.0.1v3.13.0RC3v3.14.0v3.14.0RC1v3.14.0RC2v3.14.0RC3v3.15.0v3.15.0RC1v3.15.0RC2v3.15.1v3.15.2v3.15.3v3.15.4v3.15.5v3.15.6v3.15.7v3.15.8v3.16.0v3.16.0RC1v3.16.0RC2v3.17.0v3.17.0RC1v3.17.0RC2v3.17.1v3.17.2v3.17.3v3.18.0v3.18.0RC1v3.18.0RC2v3.18.1v3.18.2v3.18.3v3.19.0 |
4.33.6 |
protobufUbuntu:24.04:LTS |
All versions, plus listed versions 3.21.12-7ubuntu13.21.12-8ubuntu13.21.12-8ubuntu53.21.12-8.23.21.12-8.2build1 Show 4 moreShow less3.21.12-8.2ubuntu0.13.21.12-8.2ubuntu0.23.21.12-8.2ubuntu0.33.21.12-8.2ubuntu0.4 |
None known |
protobufUbuntu:25.10 |
All versions, plus listed versions 3.21.12-10build23.21.12-113.21.12-11ubuntu13.21.12-11ubuntu33.21.12-11ubuntu3.1 |
None known |
protobufUbuntu:26.04:LTS |
All versions, plus listed versions 3.21.12-11ubuntu33.21.12-143.21.12-14build13.21.12-153.21.12-15ubuntu13.21.12-15ubuntu1.1 |
None known |
protobufUbuntu:24.04:LTS |
before 3.21.12-8.2ubuntu0.4, plus listed versions 3.21.12-7ubuntu13.21.12-8ubuntu13.21.12-8ubuntu53.21.12-8.23.21.12-8.2build13.21.12-8.2ubuntu0.13.21.12-8.2ubuntu0.23.21.12-8.2ubuntu0.3 |
3.21.12-8.2ubuntu0.4 |
protobufUbuntu:26.04:LTS |
before 3.21.12-15ubuntu1.1, plus listed versions 3.21.12-11ubuntu33.21.12-143.21.12-14build13.21.12-153.21.12-15ubuntu1 |
3.21.12-15ubuntu1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-6409 is a high vulnerability (CVSS 7.1) in Protocol Buffers Protobuf-php (pecl), published March 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in google/protobuf 4.33.6.
References
github.com/protocolbuffers/protobuf/security/advisories/GHSA-p2gh-cfq4-4wjc
nvd.nist.gov/vuln/detail/CVE-2026-6409
Show 7 moreShow less
security-tracker.debian.org/tracker/CVE-2026-6409
ubuntu.com/security/CVE-2026-6409
cve.org/CVERecord?id=CVE-2026-6409
Left out here: 152 versions. The JSON record has them.