In short
- CVE-2026-6409 is a HIGH (CVSS 7.1) vulnerability affecting google/protobuf.
- Chance of exploitation in the next 30 days (EPSS): 0.36%, higher than 29.8% of all vulnerabilities.
- Fix: update to 4.33.6 or later.
| Package | Affected versions | Patched versions |
|---|
| google/protobuf Packagist | < 4.33.6
| 4.33.6
|
Description
Impact
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
Patches
Patches have been released to 5.34.0-RC1 and 4.33.6.
NVD description
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
More vulnerabilities in google/protobuf
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free