Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input

published 2026-03-25 7 mo ago modified 2026-10-26 13 d ago also GHSA-p2gh-cfq4-4wjc , EUVD-2026-23268

cvss: 7.1; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits: 0; none known

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.

Patch / fix

fixed in 2 distros 2 links 2

packagist google/protobuf 4.33.6
Protocol Buffers Protobuf-php (Pecl) 4.33.6, 5.34.0-RC1

debian azure linux

protobuf Debian 12 3.21.12-3+deb12u1
protobuf Debian 13 3.21.12-11+deb13u1
protobuf Debian 14 3.21.12-16

debian advisories DEBIAN-CVE-2026-6409

protobuf Azure Linux 3.0 25.3-7

azure linux advisories AZL-83420

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 6 mo ago (2026-04-16)

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	7.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA	4.0	7.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem	package	affected	fixed in
packagist	google/protobuf	<4.33.6	4.33.6

Affected products

Protocol Buffers Protobuf-php (Pecl)

Classification

Weakness

CWE-20 Improper Input Validation
CWE-400 Uncontrolled Resource Consumption

References

Sources

CVE List CVE-2026-6409
GitHub Advisory GHSA-p2gh-cfq4-4wjc
NVD CVE-2026-6409

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary