{"id":"USN-8943-1","summary":"protobuf vulnerability","details":"It was discovered that Protocol Buffers did not properly handle negative\nvarint lengths or enforce recursion limits when parsing input in the PHP\nlibrary. An attacker could possibly use this issue to cause applications\nusing Protocol Buffers to crash or consume resources, resulting in a\ndenial of service.","modified":"2026-10-21T04:43:04.893256287Z","published":"2026-10-20T14:49:32Z","upstream":["CVE-2026-6409","UBUNTU-CVE-2026-6409"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8943-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-6409"}],"affected":[{"package":{"name":"protobuf","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/protobuf?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.12-8.2ubuntu0.4"}]}],"versions":["3.21.12-7ubuntu1","3.21.12-8ubuntu1","3.21.12-8ubuntu5","3.21.12-8.2","3.21.12-8.2build1","3.21.12-8.2ubuntu0.1","3.21.12-8.2ubuntu0.2","3.21.12-8.2ubuntu0.3"],"ecosystem_specific":{"binaries":[{"binary_version":"3.21.12-8.2ubuntu0.4","binary_name":"elpa-protobuf-mode"},{"binary_version":"3.21.12-8.2ubuntu0.4","binary_name":"libprotobuf-java"},{"binary_name":"libprotobuf-lite32t64","binary_version":"3.21.12-8.2ubuntu0.4"},{"binary_name":"libprotobuf32t64","binary_version":"3.21.12-8.2ubuntu0.4"},{"binary_version":"3.21.12-8.2ubuntu0.4","binary_name":"libprotoc32t64"},{"binary_name":"php-google-protobuf","binary_version":"3.21.12-8.2ubuntu0.4"},{"binary_name":"protobuf-compiler","binary_version":"3.21.12-8.2ubuntu0.4"},{"binary_version":"3.21.12-8.2ubuntu0.4","binary_name":"python3-protobuf"},{"binary_name":"ruby-google-protobuf","binary_version":"3.21.12-8.2ubuntu0.4"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:24.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8943-1.json"}},{"package":{"name":"protobuf","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/protobuf?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.12-15ubuntu1.1"}]}],"versions":["3.21.12-11ubuntu3","3.21.12-14","3.21.12-14build1","3.21.12-15","3.21.12-15ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.21.12-15ubuntu1.1","binary_name":"elpa-protobuf-mode"},{"binary_name":"libprotobuf-java","binary_version":"3.21.12-15ubuntu1.1"},{"binary_name":"libprotobuf-lite32t64","binary_version":"3.21.12-15ubuntu1.1"},{"binary_name":"libprotobuf32t64","binary_version":"3.21.12-15ubuntu1.1"},{"binary_version":"3.21.12-15ubuntu1.1","binary_name":"libprotoc32t64"},{"binary_name":"php-google-protobuf","binary_version":"3.21.12-15ubuntu1.1"},{"binary_name":"protobuf-compiler","binary_version":"3.21.12-15ubuntu1.1"},{"binary_version":"3.21.12-15ubuntu1.1","binary_name":"python3-protobuf"},{"binary_version":"3.21.12-15ubuntu1.1","binary_name":"ruby-google-protobuf"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8943-1.json","cves_map":{"ecosystem":"Ubuntu:26.04:LTS","cves":[]}}}],"schema_version":"1.9.0"}