google/protobuf
This repository contains only PHP files to support Composer installation. This repository is a mirror of [protobuf](https://github.com/protocolbuffers/protobuf). Any support requests, bug reports, or development contributions should be directed to that project. To install protobuf for PHP, please see https://github.com/protocolbuffers/protobuf/tree/master/php
View on Github
Activity
- Latest release
- 2w ago
- Total releases
- 201
- Cadence
- ~13 days
- Last 12 months
- 24
Reach
- Stars
- 374
Details
- License
- BSD-3-Clause
- First release
- Feb 25, 2019
Releases
| Version | Released | |
|---|---|---|
v5.36.1
patch
| ||
v5.36.0
minor
| ||
v5.36.0RC2
pre
| ||
v5.36.0RC1
pre
| ||
v5.35.1
patch
| ||
v5.34.2
patch
| ||
v5.35.0
minor
| ||
v5.35.0RC2
pre
| ||
v5.35.0RC1
pre
| ||
v3.25.9
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v5.34.1
patch
| ||
v4.33.6
patch
| ||
v5.34.0
major
| ||
v5.34.0RC2
pre
| ||
v4.29.6
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.33.5
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v5.34.0RC1
pre
| ||
v4.33.4
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.33.3
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.33.2
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.33.1
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.33.0
minor
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.33.0RC2
pre
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.33.0RC1
pre
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.32.1
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.32.0
minor
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.32.0RC2
pre
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.32.0RC1
pre
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.31.1
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.29.5
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v3.25.8
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.31.0
minor
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.31.0RC2
pre
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v3.25.7
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.31.0RC1
pre
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.30.2
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.29.4
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.30.1
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.30.0
minor
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.30.0RC2
pre
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.30.0RC1
pre
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v3.25.6
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.29.3
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.29.2
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.29.1
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.29.0
minor
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.29.0RC3
pre
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.29.0RC2
pre
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.28.3
patch
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev | ||
v4.29.0RC1
pre
1 CVE
CVE-2026-6409
GHSA-p2gh-cfq4-4wjc
Mar 25, 2026
Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion
High
Network
Low
None
ImpactA Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative PatchesPatches have been released to 5.34.0-RC1 and 4.33.6. Affected versions
v3.1.0-alpha-1
v3.10.0
v3.10.0RC1
v3.11.0
v3.11.0RC1
v3.11.0RC2
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.12.0
v3.12.0RC1
+ 190 more Show less
v3.12.0RC2
v3.12.1
v3.12.2
v3.12.4
v3.13.0
v3.13.0.1
v3.13.0RC3
v3.14.0
v3.14.0RC1
v3.14.0RC2
v3.14.0RC3
v3.15.0
v3.15.0RC1
v3.15.0RC2
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.15.5
v3.15.6
v3.15.7
v3.15.8
v3.16.0
v3.16.0RC1
v3.16.0RC2
v3.17.0
v3.17.0RC1
v3.17.0RC2
v3.17.1
v3.17.2
v3.17.3
v3.18.0
v3.18.0RC1
v3.18.0RC2
v3.18.1
v3.18.2
v3.18.3
v3.19.0
v3.19.0RC1
v3.19.0RC2
v3.19.1
v3.19.2
v3.19.3
v3.19.4
v3.19.5
v3.19.6
v3.2.0-alpha-1
v3.20.0RC1
v3.20.0RC2
v3.20.1
v3.20.1RC1
v3.20.2
v3.20.3
v3.21.0
v3.21.0RC1
v3.21.0RC2
v3.21.1
v3.21.10
v3.21.11
v3.21.12
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.22.0
v3.22.0RC3
v3.22.1
v3.22.2
v3.22.3
v3.22.4
v3.22.5
v3.23.0
v3.23.0RC1
v3.23.0RC2
v3.23.0RC3
v3.23.1
v3.23.2
v3.23.3
v3.23.4
v3.24.0
v3.24.0RC1
v3.24.0RC2
v3.24.0RC3
v3.24.1
v3.24.2
v3.24.3
v3.24.4
v3.25.0
v3.25.0RC1
v3.25.0RC2
v3.25.1
v3.25.2
v3.25.3
v3.25.4
v3.25.5
v3.25.6
v3.25.7
v3.25.8
v3.25.9
v3.3.0
v3.3.0rc1
v3.3.1
v3.3.2
v3.4.0
v3.4.0rc1
v3.4.0rc2
v3.4.0rc3
v3.4.1
v3.5.0
v3.5.0.1
v3.5.1
v3.5.1.1
v3.5.2
v3.6.0
v3.6.0.1
v3.6.0rc1
v3.6.0rc2
v3.6.1
v3.6.1.1
v3.6.1.2
v3.6.1.3
v3.7.0
v3.7.0-rc.3
v3.7.0rc1
v3.7.0rc2
v3.7.1
v3.8.0
v3.8.0RC1
v3.9.0
v3.9.0RC1
v3.9.1
v3.9.2
v4.0.0RC1
v4.0.0RC2
v4.26.0
v4.26.0RC1
v4.26.0RC2
v4.26.0RC3
v4.26.1
v4.27.0
v4.27.0RC1
v4.27.0RC2
v4.27.0RC3
v4.27.1
v4.27.2
v4.27.3
v4.27.4
v4.27.5
v4.28.0
v4.28.0RC1
v4.28.0RC2
v4.28.0RC3
v4.28.1
v4.28.2
v4.28.3
v4.29.0
v4.29.0RC1
v4.29.0RC2
v4.29.0RC3
v4.29.1
v4.29.2
v4.29.3
v4.29.4
v4.29.5
v4.29.6
v4.30.0
v4.30.0RC1
v4.30.0RC2
v4.30.1
v4.30.2
v4.31.0
v4.31.0RC1
v4.31.0RC2
v4.31.1
v4.32.0
v4.32.0RC1
v4.32.0RC2
v4.32.1
v4.33.0
v4.33.0RC1
v4.33.0RC2
v4.33.1
v4.33.2
v4.33.3
v4.33.4
v4.33.5
Fixed in
4.33.6
References
Updated Apr 16, 2026 · Source: OSV.dev |
1–50 of 201