Protocol Buffers Protobuf-php (Pecl) vulnerabilities

Latest Protocol Buffers Protobuf-php (Pecl) CVEs

Newest publication first

1. CVE-2026-6409 Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input

   Published 2026-04-16

   High·CVSS 7.1 EPSS 0.36%

   A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.