Product:
Protobuf PHP library
Summary
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages, specifically those containing negative varints or deep recursion, can be used to crash the application, impacting service availability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.1 | CVE-2026-6409 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted messages containing negative varints or deep recursion to the Protobuf PHP library. This can lead to a crash of the application, resulting in a denial of service and making the service unavailable to legitimate users.
Affected Products
- Protobuf PHP library: Vulnerable to DoS attacks through untrusted input parsing.
Mitigation
To mitigate this vulnerability, it is recommended to validate and sanitize all input before processing it with the Protobuf PHP library. Additionally, updating to the latest version of the library that addresses this issue is advised.