Skip to main content

Improper Input Validation

CVE-2026-6409

High
7.1/10

Summary

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages--specifically those containing negative `varint`s or deep recursion--can be used to crash the application, impacting service availability. Patches have been released to 5.34.0-RC1 and 4.33.6.

  • LOW
  • NETWORK
  • PASSIVE
  • NONE

CWE-20 - Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

Advisory Timeline

  • Published