CVE-2026-6409
1 advisory.
Packagist/google/protobuf CVE-2026-6409: high
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
Action: Upgrade google/protobuf to 4.33.6 or later.
composer require google/protobuf:4.33.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.33.6 | - |
Fixed versions
| 4.33.6 |
Sources
- osv: GHSA-p2gh-cfq4-4wjc
- https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-p2gh-cfq4-4wjc
- https://nvd.nist.gov/vuln/detail/CVE-2026-6409
- https://github.com/protocolbuffers/protobuf/issues/24159
- https://github.com/protocolbuffers/protobuf/issues/25067
- https://github.com/protocolbuffers/protobuf/commit/60e93d2d104f2af9cd345b1c6f3891d91430244a
- https://github.com/protocolbuffers/protobuf/commit/c8e9b27d95c6ab2d0668b5889e7dac2c477b7038
- https://github.com/protocolbuffers/protobuf
CVE-2026-6409 · published · modified · JSON