In breve
- CVE-2026-6409 è una vulnerabilità ALTO (CVSS 7.1) che riguarda google/protobuf.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.36%, superiore al 29.8% delle vulnerabilità.
- Correzione: aggiornare a 4.33.6 o successiva.
| Package | Affected versions | Patched versions |
|---|
| google/protobuf Packagist | < 4.33.6
| 4.33.6
|
Description
Impact
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
Patches
Patches have been released to 5.34.0-RC1 and 4.33.6.
NVD description
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free