DEBIAN-CVE-2026-6409

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-6409
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6409.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-6409
Upstream
  • CVE-2026-6409
Published
2026-04-16T21:04:01.011079Z
Modified
2026-04-17T05:00:11.012368Z
Summary
[none]
Details

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.

References

Affected packages

Debian:11 / protobuf

Package

Name
protobuf
Purl
pkg:deb/debian/protobuf?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.12.4-1
3.12.4-1+deb11u1
3.14.0-1
3.17.1-1
3.17.2-1
3.17.3-1
3.17.3-2
3.18.0~rc1-1
3.18.0~rc2-1
3.18.0-1
3.18.1-1
3.19.0-1
3.19.1-1
3.19.3-1
3.19.4-1
3.20.0~rc1-1
3.20.0~rc2-1
3.20.0-1
3.20.1~rc1-1
3.20.1-1
3.20.2-1
3.21.6-1
3.21.7-1
3.21.8-1
3.21.9-1
3.21.9-2
3.21.9-3
3.21.9-4
3.21.9-5
3.21.10-1
3.21.11-1
3.21.12-1
3.21.12-2
3.21.12-2+exp1
3.21.12-3
3.21.12-4
3.21.12-5
3.21.12-6
3.21.12-7
3.21.12-8
3.21.12-8.1
3.21.12-8.2
3.21.12-9
3.21.12-10
3.21.12-11
3.21.12-12
3.21.12-13
3.21.12-14
3.21.12-15
3.25.1-1
3.25.2-1
3.25.3-1
3.25.4-1
3.25.4-2
3.25.4-3
3.25.4-4
3.25.7-1
4.*
4.0.0~rc1-1
4.0.0~rc2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6409.json"

Debian:12 / protobuf

Package

Name
protobuf
Purl
pkg:deb/debian/protobuf?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.21.12-3
3.21.12-4
3.21.12-5
3.21.12-6
3.21.12-7
3.21.12-8
3.21.12-8.1
3.21.12-8.2
3.21.12-9
3.21.12-10
3.21.12-11
3.21.12-12
3.21.12-13
3.21.12-14
3.21.12-15
3.25.1-1
3.25.2-1
3.25.3-1
3.25.4-1
3.25.4-2
3.25.4-3
3.25.4-4
3.25.7-1
4.*
4.0.0~rc1-1
4.0.0~rc2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6409.json"

Debian:13 / protobuf

Package

Name
protobuf
Purl
pkg:deb/debian/protobuf?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.21.12-11
3.21.12-12
3.21.12-13
3.21.12-14
3.21.12-15
3.25.1-1
3.25.2-1
3.25.3-1
3.25.4-1
3.25.4-2
3.25.4-3
3.25.4-4
3.25.7-1
4.*
4.0.0~rc1-1
4.0.0~rc2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6409.json"

Debian:14 / protobuf

Package

Name
protobuf
Purl
pkg:deb/debian/protobuf?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.21.12-11
3.21.12-12
3.21.12-13
3.21.12-14
3.21.12-15
3.25.1-1
3.25.2-1
3.25.3-1
3.25.4-1
3.25.4-2
3.25.4-3
3.25.4-4
3.25.7-1
4.*
4.0.0~rc1-1
4.0.0~rc2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6409.json"