PT-2026-33338 · Google · Protobuf-Php

Published 2025-12-30 · Updated 2026-04-17 · CVE-2026-6409

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Protobuf PHP versions prior to 5.34.0-RC1 Protobuf PHP versions prior to 4.33.6

Description A Denial of Service (DoS) issue exists during the parsing of untrusted input. Maliciously structured messages, specifically those containing negative varints or deep recursion, can cause the application to crash, which impacts service availability.

Recommendations Update to version 5.34.0-RC1. Update to version 4.33.6.

Fix

DoS

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

BDU:2026-05664

CVE-2026-6409

ECHO-2757-275F-4ACB

GHSA-P2GH-CFQ4-4WJC

GHSA-QJFJ-3MM5-VRJG

Affected Products

Protobuf-Php

References · 18

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-6409 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-6409 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p2gh-cfq4-4wjc · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05664 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-6409 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-6409 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-6409 · Security Note
• https://ubuntu.com/security/CVE-2026-6409 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qjfj-3mm5-vrjg · Vendor Advisory
• https://github.com/protocolbuffers/protobuf/issues/24159 · Note
• https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-p2gh-cfq4-4wjc · Note
• https://github.com/protocolbuffers/protobuf/issues/25067 · Note
• https://github.com/protocolbuffers/protobuf/commit/c8e9b27d95c6ab2d0668b5889e7dac2c477b7038 · Note
• https://github.com/protocolbuffers/protobuf/commit/60e93d2d104f2af9cd345b1c6f3891d91430244a · Note
• https://github.com/protocolbuffers/protobuf · Note