Kurz gesagt
- CVE-2026-6409 ist eine Schwachstelle (HOCH (CVSS 7.1)) in google/protobuf.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.36%, höher als bei 29.8% aller Schwachstellen.
- Abhilfe: auf 4.33.6 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| google/protobuf Packagist | < 4.33.6
| 4.33.6
|
Description
Impact
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
Patches
Patches have been released to 5.34.0-RC1 and 4.33.6.
NVD description
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free