{"id":"CVE-2026-6409","aliases":["AZL-83420","CLSA-2026-1778633123","CLSA-2026-1787916992","DEBIAN-CVE-2026-6409","EUVD-2026-23268","GHSA-p2gh-cfq4-4wjc","UBUNTU-CVE-2026-6409","USN-8943-1"],"status":"published","title":"Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input","description":"A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0036,"percentile":0.30036,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-400"],"published":"2026-03-25T21:02:08Z","modified":"2026-11-09T12:50:00Z","fixes":[{"ecosystem":"Packagist","package":"google/protobuf","fixed_in":["4.33.6"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"protobuf","fixed_in":["25.3-7"],"sources":["osv"]},{"ecosystem":"TuxCare:Packagist","package":"google/protobuf","fixed_in":["3.24.4-p1+tuxcare","3.25.9-p1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"protobuf","fixed_in":["3.21.12-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"protobuf","fixed_in":["3.21.12-11+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"protobuf","fixed_in":["3.21.12-16"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"protobuf","fixed_in":["3.21.12-8.2ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"protobuf","fixed_in":["3.21.12-15ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"google/protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.33.6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-7"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"google/protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.24.4"},{"fixed":"3.24.4-p1+tuxcare"}]}],"versions":["3.24.4"]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"google/protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.25.9"},{"fixed":"3.25.9-p1+tuxcare"}]}],"versions":["3.25.9"]},{"source":"osv","ecosystem":"Debian:12","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.12-3+deb12u1"}]}],"versions":["3.21.12-3"]},{"source":"osv","ecosystem":"Debian:13","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.12-11+deb13u1"}]}],"versions":["3.21.12-11"]},{"source":"osv","ecosystem":"Debian:14","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.12-16"}]}],"versions":["3.21.12-11","3.21.12-12","3.21.12-13","3.21.12-14","3.21.12-15"]},{"source":"osv","ecosystem":"Packagist","package":"google/protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.33.6"}]}],"versions":["v3.1.0-alpha-1","v3.10.0","v3.10.0RC1","v3.11.0","v3.11.0RC1","v3.11.0RC2","v3.11.1","v3.11.2","v3.11.3","v3.11.4","v3.12.0","v3.12.0RC1","v3.12.0RC2","v3.12.1","v3.12.2","v3.12.4","v3.13.0","v3.13.0.1","v3.13.0RC3","v3.14.0","v3.14.0RC1","v3.14.0RC2","v3.14.0RC3","v3.15.0","v3.15.0RC1","v3.15.0RC2","v3.15.1","v3.15.2","v3.15.3","v3.15.4","v3.15.5","v3.15.6","v3.15.7","v3.15.8","v3.16.0","v3.16.0RC1","v3.16.0RC2","v3.17.0","v3.17.0RC1","v3.17.0RC2","v3.17.1","v3.17.2","v3.17.3","v3.18.0","v3.18.0RC1","v3.18.0RC2","v3.18.1","v3.18.2","v3.18.3","v3.19.0","v3.19.0RC1","v3.19.0RC2","v3.19.1","v3.19.2","v3.19.3","v3.19.4","v3.19.5","v3.19.6","v3.2.0-alpha-1","v3.20.0RC1","v3.20.0RC2","v3.20.1","v3.20.1RC1","v3.20.2","v3.20.3","v3.21.0","v3.21.0RC1","v3.21.0RC2","v3.21.1","v3.21.10","v3.21.11","v3.21.12","v3.21.2","v3.21.3","v3.21.4","v3.21.5","v3.21.6","v3.21.7","v3.21.8","v3.21.9","v3.22.0","v3.22.0RC3","v3.22.1","v3.22.2","v3.22.3","v3.22.4","v3.22.5","v3.23.0","v3.23.0RC1","v3.23.0RC2","v3.23.0RC3","v3.23.1","v3.23.2","v3.23.3","v3.23.4","v3.24.0","v3.24.0RC1","v3.24.0RC2","v3.24.0RC3","v3.24.1","v3.24.2","v3.24.3","v3.24.4","v3.25.0","v3.25.0RC1","v3.25.0RC2","v3.25.1","v3.25.2","v3.25.3","v3.25.4","v3.25.5","v3.25.6","v3.25.7","v3.25.8","v3.25.9","v3.3.0","v3.3.0rc1","v3.3.1","v3.3.2","v3.4.0","v3.4.0rc1","v3.4.0rc2","v3.4.0rc3","v3.4.1","v3.5.0","v3.5.0.1","v3.5.1","v3.5.1.1","v3.5.2","v3.6.0","v3.6.0.1","v3.6.0rc1","v3.6.0rc2","v3.6.1","v3.6.1.1","v3.6.1.2","v3.6.1.3","v3.7.0","v3.7.0-rc.3","v3.7.0rc1","v3.7.0rc2","v3.7.1","v3.8.0","v3.8.0RC1","v3.9.0","v3.9.0RC1","v3.9.1","v3.9.2","v4.0.0RC1","v4.0.0RC2","v4.26.0","v4.26.0RC1","v4.26.0RC2","v4.26.0RC3","v4.26.1","v4.27.0","v4.27.0RC1","v4.27.0RC2","v4.27.0RC3","v4.27.1","v4.27.2","v4.27.3","v4.27.4","v4.27.5","v4.28.0","v4.28.0RC1","v4.28.0RC2","v4.28.0RC3","v4.28.1","v4.28.2","v4.28.3","v4.29.0","v4.29.0RC1","v4.29.0RC2","v4.29.0RC3","v4.29.1","v4.29.2","v4.29.3","v4.29.4","v4.29.5","v4.29.6","v4.30.0","v4.30.0RC1","v4.30.0RC2","v4.30.1","v4.30.2","v4.31.0","v4.31.0RC1","v4.31.0RC2","v4.31.1","v4.32.0","v4.32.0RC1","v4.32.0RC2","v4.32.1","v4.33.0","v4.33.0RC1","v4.33.0RC2","v4.33.1","v4.33.2","v4.33.3","v4.33.4","v4.33.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.21.12-10build2","3.21.12-11","3.21.12-11ubuntu1","3.21.12-11ubuntu3","3.21.12-11ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.12-8.2ubuntu0.4"}]}],"versions":["3.21.12-7ubuntu1","3.21.12-8ubuntu1","3.21.12-8ubuntu5","3.21.12-8.2","3.21.12-8.2build1","3.21.12-8.2ubuntu0.1","3.21.12-8.2ubuntu0.2","3.21.12-8.2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.12-15ubuntu1.1"}]}],"versions":["3.21.12-11ubuntu3","3.21.12-14","3.21.12-14build1","3.21.12-15","3.21.12-15ubuntu1"]}],"products":[{"vendor":"protocol buffers","product":"protobuf-php (pecl)"}],"references":[{"url":"https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-p2gh-cfq4-4wjc","tags":["advisory","web","report"]},{"url":"https://github.com/protocolbuffers/protobuf/issues/24159","tags":["web"]},{"url":"https://github.com/protocolbuffers/protobuf/issues/25067","tags":["web"]},{"url":"https://github.com/protocolbuffers/protobuf/commit/60e93d2d104f2af9cd345b1c6f3891d91430244a","tags":["web"]},{"url":"https://github.com/protocolbuffers/protobuf/commit/c8e9b27d95c6ab2d0668b5889e7dac2c477b7038","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6409","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-p2gh-cfq4-4wjc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6409.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-6409","tags":["advisory"]},{"url":"https://github.com/protocolbuffers/protobuf","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-6409","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6409","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8943-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-6409","title":"Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input","description":"A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.","status":"published","published":"2026-04-16T14:30:51.568Z","modified":"2026-04-16T15:24:43.164Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T13:50:04.986624Z"}],"euvd":[{"id":"EUVD-2026-23268","description":"A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.","status":"published","published":"2026-04-16T14:30:51Z","modified":"2026-04-16T15:24:43Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:24:23.841547Z"}],"ghsa":[{"id":"GHSA-p2gh-cfq4-4wjc","title":"Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion","description":"### Impact\nA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative `varint`s or deep recursion—can be used to crash the application, impacting service availability.\n\n### Patches\nPatches have been released to 5.34.0-RC1 and 4.33.6.","status":"published","published":"2026-03-25T21:02:08Z","modified":"2026-04-16T22:59:38Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:39:55.105822Z"}],"nvd":[{"id":"CVE-2026-6409","description":"A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.","status":"published","published":"2026-04-16T15:17:41.91Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:15.120927Z"}],"osv":[{"id":"CVE-2026-6409","title":"Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input","description":"A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.","status":"published","published":"2026-04-16T14:30:51.568Z","modified":"2026-10-28T11:17:10.072615353Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:45:13.752441Z"},{"id":"DEBIAN-CVE-2026-6409","description":"A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.","status":"published","published":"2026-04-16T15:17:41.91Z","modified":"2026-10-27T09:47:36.36207237Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:58.307012Z"},{"id":"GHSA-p2gh-cfq4-4wjc","title":"Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion","description":"### Impact\nA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative `varint`s or deep recursion—can be used to crash the application, impacting service availability.\n\n### Patches\nPatches have been released to 5.34.0-RC1 and 4.33.6.","status":"published","published":"2026-03-25T21:02:08Z","modified":"2026-04-16T23:26:24.868199Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"UBUNTU-CVE-2026-6409","description":"A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.","status":"published","published":"2026-04-16T15:17:00Z","modified":"2026-11-09T12:50:00.832918612Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-09T13:27:33.428057Z"},{"id":"AZL-83420","title":"CVE-2026-6409 affecting package protobuf for versions less than 25.3-7","description":"A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.","status":"published","published":"2026-04-16T15:17:41Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"CLSA-2026-1778633123","title":"TuxCare security update for google/protobuf (1 CVE)","description":"TuxCare rebuilt google/protobuf to address 1 CVE. Fixed in 3.24.4-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:47:59.544253068Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1787916992","title":"TuxCare security update for google/protobuf (1 CVE)","description":"TuxCare rebuilt google/protobuf to address 1 CVE. Fixed in 3.25.9-p1+tuxcare.","status":"published","published":"2026-08-28T11:36:32Z","modified":"2026-10-15T09:48:00.486683554Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"USN-8943-1","title":"protobuf vulnerability","description":"It was discovered that Protocol Buffers did not properly handle negative\nvarint lengths or enforce recursion limits when parsing input in the PHP\nlibrary. An attacker could possibly use this issue to cause applications\nusing Protocol Buffers to crash or consume resources, resulting in a\ndenial of service.","status":"published","published":"2026-10-20T14:49:32Z","modified":"2026-10-21T04:43:04.893256287Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}