UpHeron
All vulnerabilities

Packagist

CVE-2026-6409

Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion

Severity
High
Published
25 Mar 2026
Last changed
16 Apr 2026
Added to UpHeron
22 Oct 2026
Fixed in
4.33.6
Also known as
GHSA-p2gh-cfq4-4wjc
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
google/protobufPackagist · osv:Packagist:google/protobuf
  • Every version before 4.33.6

References