Which versions of Protobuf PHP are affected by CVE-2026-6409?

The google/protobuf PHP library (versions 4.x prior to 4.33.6 and 5.x prior to 5.34.0-RC1) contains a denial-of-service vulnerability that allows remote attackers to crash PHP applications through…. A patch is available.

How to fix or mitigate CVE-2026-6409?

Within 24 hours, identify all PHP applications using google/protobuf through dependency scanning (composer.lock or automated dependency checker). Within 7 days, upgrade all instances to google/protobuf version 4.33.6 or later (4.x line) or 5.34.0 or later (5.x line) and conduct regression testing to validate application stability. Within 30 days, review and reinforce input validation and rate-limiting controls on Protocol Buffer deserialization endpoints to reduce attack surface.

Protobuf PHP CVE-2026-6409

Q: What is the CVSS score of CVE-2026-6409?

CVE-2026-6409 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-23268 HIGH

Improper Input Validation (CWE-20)

2026-04-16 cve-coordination@google.com

GHSA-p2gh-cfq4-4wjc

PHP Denial Of Service

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote, unauthenticated, low-complexity parsing of untrusted input with availability-only impact; UI:N because server-side protobuf decoding needs no user interaction, and C:N/I:N as no data is exposed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:33 vuln.today

Analysis Generated

Jul 24, 2026 - 07:33 vuln.today

Patch released

Apr 17, 2026 - 15:17 nvd

Patch available

Apr 16, 2026 - 16:02 EUVD

EUVD ID Assigned

Apr 16, 2026 - 15:22 euvd

EUVD-2026-23268

CVE Published

Apr 16, 2026 - 15:17 nvd

HIGH 7.1

DescriptionCVE.org

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages-specifically those containing negative varints or deep recursion-can be used to crash the application, impacting service availability.

AnalysisAI

Denial of service in the Protobuf PHP library (protobuf-php / composer google/protobuf) allows remote attackers to crash applications that deserialize untrusted Protocol Buffers input by submitting messages containing negative varints or excessively deep nested recursion. All versions below 4.33.6 (and the 5.x line prior to 5.34.0-RC1) are affected; there is no public exploit identified at time of analysis, and EPSS is low at 0.07%, but a vendor patch is available and the issue was reported by Google's CVE coordination team.

Technical ContextAI

Protocol Buffers is Google's binary serialization format, and this flaw is in its PHP implementation (the PECL/Composer google/protobuf package) within the wire-format decoder that parses incoming messages. The root cause is CWE-20 (Improper Input Validation): the parser fails to safely handle two adversarial encodings - varints encoding negative/oversized integer values, and deeply nested submessages that drive unbounded recursion during decode. Because protobuf decoding runs before any application-level validation, a single malformed message reaching the parser (via an API endpoint, RPC handler, or message queue consumer) can exhaust the stack or trigger an abort, terminating the worker or process.

RemediationAI

Vendor-released patch: upgrade to 4.33.6 on the 4.x branch or to 5.34.0-RC1 on the 5.x branch (fixes committed in 60e93d2d104f2af9cd345b1c6f3891d91430244a and c8e9b27d95c6ab2d0668b5889e7dac2c477b7038), per GHSA-p2gh-cfq4-4wjc. For Composer projects run 'composer require google/protobuf:^4.33.6' (or the 5.x fixed release) and redeploy; for the PECL extension, update the installed protobuf-php package. If you cannot patch immediately, reduce exposure by enforcing strict limits before decode - cap maximum message size and recursion/nesting depth on inbound protobuf payloads, and terminate connections that exceed them (trade-off: legitimate large or deeply-nested messages may be rejected); restrict the endpoints that accept protobuf input to authenticated or trusted sources, and place them behind a proxy/WAF that enforces request-size limits (trade-off: adds latency and does not stop authenticated abuse). Validate the exact fixed version against the advisory before rollout since 5.34.0-RC1 is a release candidate.