Skip to content
OpenAdvisories
High USN-8943-1 1 CVE

protobuf vulnerability

Published Oct 20, 2026 · Updated Oct 21, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Protocol Buffers did not properly handle negative
varint lengths or enforce recursion limits when parsing input in the PHP
library. An attacker could possibly use this issue to cause applications
using Protocol Buffers to crash or consume resources, resulting in a
denial of service.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS protobuf 3.21.12-8.2ubuntu0.4
Ubuntu · 26.04 LTS 26.04:LTS protobuf 3.21.12-15ubuntu1.1

Vulnerabilities 1

  • High 7.1
    CVE-2026-6409

    Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input

    A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting …

    Protocol Buffers Protobuf-php (Pecl) protobuf protobuf Debian Ubuntu Azure Linux Packagist

References

  • report
    https://ubuntu.com/security/CVE-2026-6409