CVE-2026-6409 Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input
Attackers can crash applications using the Protobuf PHP library by sending maliciously structured messages with negative varints or deep recursion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-6409?
CVE-2026-6409 is a high-severity denial of service vulnerability in Protocol Buffers Protobuf-php (Pecl), published on 16 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
Weakness: CWE-20
Which versions are affected by CVE-2026-6409?
2 open source packages ship an affected version, including google/protobuf.
| Package | Affected | Fixed in |
|---|---|---|
google/protobuf Packagist | All versions | 4.33.6 |
google/protobuf Packagist | All versions | 4.33.6 |
How do I fix CVE-2026-6409?
Upgrade google/protobuf to 4.33.6 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-6409 being exploited?
There is no known exploitation of CVE-2026-6409 in the wild and no public exploit code.
Sources
Also known as AZL-83420, CLSA-2026-1778633123, CLSA-2026-1787916992, DEBIAN-CVE-2026-6409, ECHO-2757-275f-4acb, GHSA-p2gh-cfq4-4wjc and 2 more.