{"action":"Upgrade google/protobuf to 4.33.6 or later.","affected":[{"fixed":"4.33.6","introduced":"0"}],"component":"google/protobuf","cve_ids":["CVE-2026-6409"],"ecosystem":"Packagist","epss":0.0036,"exploited":false,"fixed_versions":["4.33.6"],"ghsa_id":"GHSA-p2gh-cfq4-4wjc","id":"tcs_01M5KF5Z973F2VWBZ0W1TY4XDT","modified_at":"2026-04-16T23:26:24.868199Z","published_at":"2026-03-25T21:02:08Z","references":["https://osv.dev/vulnerability/GHSA-p2gh-cfq4-4wjc","https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-p2gh-cfq4-4wjc","https://nvd.nist.gov/vuln/detail/CVE-2026-6409","https://github.com/protocolbuffers/protobuf/issues/24159","https://github.com/protocolbuffers/protobuf/issues/25067","https://github.com/protocolbuffers/protobuf/commit/60e93d2d104f2af9cd345b1c6f3891d91430244a","https://github.com/protocolbuffers/protobuf/commit/c8e9b27d95c6ab2d0668b5889e7dac2c477b7038","https://github.com/protocolbuffers/protobuf"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-p2gh-cfq4-4wjc","url":"https://osv.dev/vulnerability/GHSA-p2gh-cfq4-4wjc"}],"summary":"Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion"}