Home / mailings

PDF

[USN-8943-1] Protocol Buffers vulnerability

Posted on 20 October 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8943-1
October 20, 2026

protobuf vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS

Summary:

Protocol Buffers could be made to crash if it received specially crafted
input.

Software Description:
- protobuf: protocol buffers data serialization library

Details:

It was discovered that Protocol Buffers did not properly handle negative
varint lengths or enforce recursion limits when parsing input in the PHP
library. An attacker could possibly use this issue to cause applications
using Protocol Buffers to crash or consume resources, resulting in a
denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
php-google-protobuf 3.21.12-15ubuntu1.1

Ubuntu 24.04 LTS
php-google-protobuf 3.21.12-8.2ubuntu0.4

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8943-1
CVE-2026-6409

Package Information:
https://launchpad.net/ubuntu/+source/protobuf/3.21.12-15ubuntu1.1
https://launchpad.net/ubuntu/+source/protobuf/3.21.12-8.2ubuntu0.4

--===============8956474961976259348==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP