CVE-2026-6409
Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 7.1EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
16 abr 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
Protocol Buffers · Protobuf-php (Pecl)