En resumen
- CVE-2026-6409 es una vulnerabilidad ALTO (CVSS 7.1) que afecta a google/protobuf.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.36%, mayor que el 29.8% de las vulnerabilidades.
- Solución: actualizar a 4.33.6 o posterior.
| Package | Affected versions | Patched versions |
|---|
| google/protobuf Packagist | < 4.33.6
| 4.33.6
|
Description
Impact
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
Patches
Patches have been released to 5.34.0-RC1 and 4.33.6.
NVD description
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free