CVE-2026-6409 — Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input

CVE-2026-6409

Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input PUBLISHED

Description (CNA)

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.

Affected (CNA)

Vendor / product	Versions
Protocol Buffers / Protobuf-php (Pecl)	affected 0 before 5.34.0-RC1; affected 0 before 4.33.6

CWE

CWE-20

References

https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-p2gh-cfq4-4wjc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.