PT-2026-33338

CVE-2026-6409

Published

2025-12-30

Updated

2026-08-10

Description by

CVSS 2.0

7.8

High

MetricsAV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Protobuf PHP versions prior to 5.34.0-RC1 Protobuf PHP versions prior to 4.33.6

Description A Denial of Service (DoS) issue exists during the parsing of untrusted input. Maliciously structured messages, specifically those containing negative varints or deep recursion, can cause the application to crash, which impacts service availability.

Recommendations Update to version 5.34.0-RC1. Update to version 4.33.6.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-400: Uncontrolled Resource Consumption

CWE-20: Improper Input Validation

Related identifiers

CVE-2026-6409