This vulnerability (CVE-2026-6409) in the Protocol Buffers PHP library arises from improper input validation (CWE-20) during parsing of untrusted input. Malicious messages with negative varints or deeply recursive structures can cause the application to crash, resulting in denial of service. The CVSS 4.0 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vendor has not published a patch or official remediation level, and no known exploits are reported.

Successful exploitation causes denial of service by crashing the application handling Protobuf messages. This impacts service availability but does not indicate code execution or data breach. No known active exploitation is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing input validation or filtering to block malformed Protobuf messages containing negative varints or excessive recursion. Monitor for updates from the Protocol Buffers project regarding official fixes.