Ubuntu patches Protocol Buffers DoS flaw in PHP (CVE-2026-6409)
Canonical releases patch for php-google-protobuf package on Ubuntu 24.04 and 26.04 LTS: fixes DoS vulnerability exploitable via malformed input.
UptimeMag editorial team · 21 October 2026 · 1 min read
Canonical published USN-8943-1 on 20 October 2026, addressing a denial-of-service vulnerability in the PHP Protocol Buffers library (protobuf). It affects Ubuntu 24.04 LTS and 26.04 LTS users running PHP applications that deserialise protobuf messages from external sources: internal APIs, microservices, message queues.
The issue
The vulnerability, identified as CVE-2026-6409, has been known for some time: maliciously structured messages, specifically those containing negative varints or deep recursion, can be used to crash the application, compromising service availability. The issue is classified as CWE-20, improper input validation, and carries a CVSS score of 7.1/10, high severity.
According to the package changelog, Canonical applied two separate patches: one rejects negative length values in the readRaw function in CodedInputStream.php, the other imposes a recursion limit in the same file.
It should be noted that this flaw is not brand new: it was published on 16 April 2026. Approximately six months elapsed before the patch reached Ubuntu. Administrators managing Debian systems should take note: at the time of writing the official tracker marks protobuf packages in bullseye, bookworm, trixie, forky and sid as still vulnerable, with no patched version available.
How to update
On affected systems, the standard update cycle suffices:
sudo apt update && sudo apt upgrade
The corrected package versions are:
| Ubuntu Release | Package | Corrected version |
|---|---|---|
| 24.04 LTS (noble) | php-google-protobuf | 3.21.12-8.2ubuntu0.4 |
| 26.04 LTS (resolute) | php-google-protobuf | 3.21.12-15ubuntu1.1 |
Users who installed Protobuf-php via PECL rather than from system repositories should check the version separately: according to OpenCVE the upstream corrected versions are affected < 5.34.0-RC1 and affected < 4.33.6, so 4.33.6 or 5.34.0-RC1 and later.
No public exploits are currently known to be in circulation: no proven exploits have appeared in public advisories according to OpenCVE's analysis.
Written with the help of artificial intelligence and checked by the editors (EU AI Act, art. 50).