PT-2026-33338 · Protocol Buffers · Protobuf-Php

Published 2026-04-16 · Updated 2026-04-16 · CVE-2026-6409

NVD

CVSS v4.0

7.1

High

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-6409

Affected Products

Protobuf-Php

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-6409 · Security Note
• https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-p2gh-cfq4-4wjc · Note