CVE-2026-6409

EUVD-2026-23268
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 28.66%
Debian logo
Debian Releases
Debian Product
Codename
protobuf
bookworm
3.21.12-3+deb12u1
fixed
bullseye
postponed
forky
3.21.12-16
fixed
sid
3.21.12-16
fixed
trixie
3.21.12-11+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
protobuf
bionic
needed
focal
needed
jammy
needed
noble
needed
questing
ignored
resolute
needed
trusty
needed
xenial
needed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
protobuf
Azure Linux 3.0
0:25.3-7.azl3
fixed
Common Weakness Enumeration
References
https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-p2gh-cfq4-4wjc