{
  "cveId": "CVE-2026-6409",
  "url": "https://patchblox.com/security/cve/CVE-2026-6409",
  "summary": "CVE-2026-6409 is fixed in protobuf on 1 platform, first by DEBIAN-CVE-2026-6409, released April 16, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input",
  "description": "A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages\u2014specifically those containing negative\u00A0varints or deep recursion\u2014can be used to crash the application, impacting service availability.",
  "published": "2026-04-16T15:17:41Z",
  "severity": "Important",
  "cwe": "Improper Input Validation",
  "epss": 0.0036,
  "epssPercentile": 0.29944,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-6409",
  "fixes": [
    {
      "platform": "linux",
      "product": "protobuf",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3.21.12-3\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2026-6409",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-6409",
      "released": "2026-04-16T15:17:41Z"
    },
    {
      "platform": "linux",
      "product": "protobuf",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.21.12-11\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2026-6409",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-6409",
      "released": "2026-04-16T15:17:41Z"
    },
    {
      "platform": "linux",
      "product": "protobuf",
      "release": "Debian 14",
      "fixedVersion": "3.21.12-16",
      "fix": "DEBIAN-CVE-2026-6409",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-6409",
      "released": "2026-04-16T15:17:41Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}