Your message dated Sat, 04 Jul 2026 16:25:36 +0000
with message-id <[email protected]>
and subject line Bug#1134895: fixed in protobuf 35.1-1
has caused the Debian Bug report #1134895,
regarding protobuf: CVE-2026-6409
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1134895: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134895
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: protobuf
X-Debbugs-CC: [email protected]
Severity: important
Tags: security
Hi,
The following vulnerability was published for protobuf.
CVE-2026-6409[0]:
| A Denial of Service (DoS) vulnerability exists in the Protobuf PHP
| library during the parsing of untrusted input. Maliciously
| structured messages—specifically those containing negative varints
| or deep recursion—can be used to crash the application, impacting
| service availability.
https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-p2gh-cfq4-4wjc
https://github.com/protocolbuffers/protobuf/issues/24159
https://github.com/protocolbuffers/protobuf/commit/60e93d2d104f2af9cd345b1c6f3891d91430244a
(v4.33.6)
https://github.com/protocolbuffers/protobuf/issues/25067
https://github.com/protocolbuffers/protobuf/commit/c8e9b27d95c6ab2d0668b5889e7dac2c477b7038
(v4.33.6)
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-6409
https://www.cve.org/CVERecord?id=CVE-2026-6409
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: protobuf
Source-Version: 35.1-1
Done: Laszlo Boszormenyi (GCS) <[email protected]>
We believe that the bug you reported is fixed in the latest version of
protobuf, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Laszlo Boszormenyi (GCS) <[email protected]> (supplier of updated protobuf
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 20 Jun 2026 16:37:31 +0200
Source: protobuf
Binary: elpa-protobuf-mode libprotobuf-dev libprotobuf-java libprotobuf-lite35
libprotobuf-lite35-dbgsym libprotobuf35 libprotobuf35-dbgsym libprotoc-dev
libprotoc35 libprotoc35-dbgsym php-google-protobuf protobuf-compiler
protobuf-compiler-dbgsym python3-protobuf ruby-google-protobuf
ruby-google-protobuf-dbgsym
Architecture: source all amd64
Version: 35.1-1
Distribution: experimental
Urgency: medium
Maintainer: Laszlo Boszormenyi (GCS) <[email protected]>
Changed-By: Laszlo Boszormenyi (GCS) <[email protected]>
Description:
elpa-protobuf-mode - Emacs addon for editing protocol buffers
libprotobuf-dev - protocol buffers C++ library (development files) and proto
files
libprotobuf-java - Java bindings for protocol buffers
libprotobuf-lite35 - protocol buffers C++ library (lite version)
libprotobuf35 - protocol buffers C++ library
libprotoc-dev - protocol buffers compiler library (development files)
libprotoc35 - protocol buffers compiler library
php-google-protobuf - PHP bindings for protocol buffers
protobuf-compiler - compiler for protocol buffer definition files
python3-protobuf - Python 3 bindings for protocol buffers
ruby-google-protobuf - Protocol Buffers
Closes: 1134895
Changes:
protobuf (35.1-1) experimental; urgency=medium
.
[ Laszlo Boszormenyi (GCS) ]
* New major upstream release:
- fix CVE-2026-6409: denial of service vulnerability in the PHP
bindings (closes: #1134895).
* Build with external utf8-range library.
* Update patches.
* Library transition from libproto*25 to libproto*35 .
* Update homepage location.
* Remove now redundant Rules-Requires-Root value.
* Update copyright file.
* Update watch file.
* Update Standards-Version to 4.7.2 .
.
[ Ying-Chun Liu (PaulLiu) <[email protected]> ]
* Fix python3-protobuf build.
* Fix libprotobuf-java build.
* Fix ruby-google-protobuf build.
Checksums-Sha1:
791120efe2180777e659d27683aa322b54fe42b2 3119 protobuf_35.1-1.dsc
a8d73e7f5d7aae558eab17a8212918643ee4391a 7153431 protobuf_35.1.orig.tar.gz
d2ead808c4f1692ae7d04431221fcaffb37520e5 38616 protobuf_35.1-1.debian.tar.xz
8b8759e2e11dbfdfdef0d09b4c4606b41aaa6395 8944 elpa-protobuf-mode_35.1-1_all.deb
7b7b44b0c7384c90976250109b22e7a09bb7ad34 2303612
libprotobuf-dev_35.1-1_amd64.deb
e32e05f2ea35418ad4e4dca2e9a406c492eb0929 1252824
libprotobuf-java_35.1-1_all.deb
391f4c22dbd1b381295616942bf1b0941c36f191 3725356
libprotobuf-lite35-dbgsym_35.1-1_amd64.deb
087ac54af06bba3a10d9486c2b6b36ffe01de2e7 279708
libprotobuf-lite35_35.1-1_amd64.deb
627df4ffa631248c90663266b648f1e9af16ff50 23895172
libprotobuf35-dbgsym_35.1-1_amd64.deb
c673ff46a47a27bfdcb3858f95967398a5465d1d 1279312 libprotobuf35_35.1-1_amd64.deb
ef4c27654df15fafe54973aa8aaba7ff34abcfde 66420588
libprotoc-dev_35.1-1_amd64.deb
db9497e3b44ee05c4879f57014b9c0a1965f70e2 55484908
libprotoc35-dbgsym_35.1-1_amd64.deb
662a939fbee1dbe04c998884c8f50572c85b7258 1583824 libprotoc35_35.1-1_amd64.deb
f13fdda99479a3d039d9c7afe586bcfc7df9b73d 79764
php-google-protobuf_35.1-1_all.deb
37d89a3a76f8ea8c5314301f5cbe16b2e8a46c93 7887096
protobuf-compiler-dbgsym_35.1-1_amd64.deb
a319933770b8a4f3c5de6ea0a0f65ec07d56a463 299592
protobuf-compiler_35.1-1_amd64.deb
4e793e2c0f71e97d76742a00f487c0275b3d80b5 21768 protobuf_35.1-1_amd64.buildinfo
8e870de5980d7e35c2e52ef648c8e2b15452a912 117340
python3-protobuf_35.1-1_amd64.deb
605c57cccb2dbe7bbdc80da2d04c8cfd7f7ba0d8 867504
ruby-google-protobuf-dbgsym_35.1-1_amd64.deb
43edcbfa25f4383a6d34dc5e818e31b21c61b238 170384
ruby-google-protobuf_35.1-1_amd64.deb
Checksums-Sha256:
68658ebeed1b2f49fc9af580ef62929e58bbf300d7c099cf84d466b87e41e80b 3119
protobuf_35.1-1.dsc
22775f9376938295efa2d59a59bde4cd075a42df5a9b4d27aa9b99fa6a413bd2 7153431
protobuf_35.1.orig.tar.gz
7890f30ba2debbe9cab2b93beeadac2f4da0eb145eda2464012f005b96eac16a 38616
protobuf_35.1-1.debian.tar.xz
826bb46ec4c9b65348c217e0a8dc6e780a753a5fd59cab9d41b77a27b8a506e4 8944
elpa-protobuf-mode_35.1-1_all.deb
9587295524371e3e780c26b9b49a9d468fffc10a9a5085c63c71e5ce0cb53540 2303612
libprotobuf-dev_35.1-1_amd64.deb
36732ad89ee1518effb3fa32e0e7cf80350a7bfb15e4f43ee803fef73b3e619e 1252824
libprotobuf-java_35.1-1_all.deb
e884eefade540625bb4e4d40cbc1a11b5ffd9f2c89b62d8fadf9d8b20931b62b 3725356
libprotobuf-lite35-dbgsym_35.1-1_amd64.deb
d7805c3d42e2ee787ff42ea947ef3d22ac376f30aed5b2fc445e138fc58992f6 279708
libprotobuf-lite35_35.1-1_amd64.deb
28dd290edf4cc29915648473fddaf6ab116bd69b901bae4c290fb082cb114c7c 23895172
libprotobuf35-dbgsym_35.1-1_amd64.deb
f78599495f0c468f211c8af04da72bcb1a2168a0e153657c7b289093ff576752 1279312
libprotobuf35_35.1-1_amd64.deb
7b67b15a317f8a1878207c9afdf4bb339520084919209ce5ac51b0ec7be55e9b 66420588
libprotoc-dev_35.1-1_amd64.deb
af19f4308d784ff840c6efc44b80831c80951a17dd24053ad3f2da38c545942e 55484908
libprotoc35-dbgsym_35.1-1_amd64.deb
4f5582f0696a4b30c8eaf236a55a9fa61097a0f833eef9f607366f05538676c9 1583824
libprotoc35_35.1-1_amd64.deb
08f22adc3555894e2d38d59f2067873c1fa676a17b24e10976b795401b60560b 79764
php-google-protobuf_35.1-1_all.deb
0ad852b9ff324dc62123fdfa659df7fb4f434ea6ec4ffbd159d4c23e2d656a03 7887096
protobuf-compiler-dbgsym_35.1-1_amd64.deb
345cb085a28280a2ee9d75b180814f85968d740b2010491b7e5454f60ef8753a 299592
protobuf-compiler_35.1-1_amd64.deb
b25d245704cdcc66849efce89507d3f9a8a4b55c3f22697cc4d0e94f240f0882 21768
protobuf_35.1-1_amd64.buildinfo
1208d328e61ecd8e0d91fa75bb02749063fa90f4de9cb9b85301860daddcd3ee 117340
python3-protobuf_35.1-1_amd64.deb
96c89bff558da7a87c487f3561021a2aeb0530472fa0d9d14f3336944329e4a4 867504
ruby-google-protobuf-dbgsym_35.1-1_amd64.deb
fb9499bf07b77f0fdab050cadb93b0b708563a1bd498ab774171a4a5d1b9e7f6 170384
ruby-google-protobuf_35.1-1_amd64.deb
Files:
4b7bc94dcf567679e537e738ace52e16 3119 devel optional protobuf_35.1-1.dsc
a05f9d48606773f52252988f0be87e84 7153431 devel optional
protobuf_35.1.orig.tar.gz
0f54857510f700a3f11515748555e2e8 38616 devel optional
protobuf_35.1-1.debian.tar.xz
cb10adc73f93f4bda9da1bbb67c83e80 8944 editors optional
elpa-protobuf-mode_35.1-1_all.deb
0d54ebf8ffa3394a36f011d72ac21572 2303612 libdevel optional
libprotobuf-dev_35.1-1_amd64.deb
a46a62efd8a957b4e2c644c8aea9a2f8 1252824 java optional
libprotobuf-java_35.1-1_all.deb
93fe4edadc7385082cacc42fa524aedf 3725356 debug optional
libprotobuf-lite35-dbgsym_35.1-1_amd64.deb
26814dd32ac16121426aae1f74bb5c8a 279708 libs optional
libprotobuf-lite35_35.1-1_amd64.deb
fd0edddffb67c614fb4224fd9b187b25 23895172 debug optional
libprotobuf35-dbgsym_35.1-1_amd64.deb
cdf773d8a00be5df5a9e01a62ee00d2f 1279312 libs optional
libprotobuf35_35.1-1_amd64.deb
789551160796b03bfdfd05eb87f2f64a 66420588 libdevel optional
libprotoc-dev_35.1-1_amd64.deb
a57371f0c0d49578f757c77f3c13d174 55484908 debug optional
libprotoc35-dbgsym_35.1-1_amd64.deb
62c156ebac94642d28921161f5b8abcd 1583824 libs optional
libprotoc35_35.1-1_amd64.deb
5399beeb7df08cd9fc51e3d2dfb315fd 79764 php optional
php-google-protobuf_35.1-1_all.deb
9688048e03abf6eddd4e3003232269f2 7887096 debug optional
protobuf-compiler-dbgsym_35.1-1_amd64.deb
d9212061f0ab33efcf6a829d9eccae55 299592 devel optional
protobuf-compiler_35.1-1_amd64.deb
b0f25cef096303fda3741d7a6f2faa06 21768 devel optional
protobuf_35.1-1_amd64.buildinfo
767336b42a9fae6df19306c3025d9647 117340 python optional
python3-protobuf_35.1-1_amd64.deb
0c9ba0202ae467af8e9ec6481890550c 867504 debug optional
ruby-google-protobuf-dbgsym_35.1-1_amd64.deb
440adc5cc89b295e2a04e7ebc0c977f9 170384 ruby optional
ruby-google-protobuf_35.1-1_amd64.deb
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAmo78X4ACgkQ3OMQ54ZM
yL8QjA/+P7li/bxhx1XFtSIGRsktHhjClrDuK0HnDA4ekniOrg9yAI76iDdR3pDT
+rP6JQwM47qotVuqBCTGAXABrx0WpY/2o+RFF/fb+VFbjOPjPQB0/gSRlAzge/nx
5ZTgfnFV8ICdRX8l7eiYCfh0nw9Q27ck8Owz3vUrEbHGXIRPEl+Bb8I79/yKJYP0
vywCadRYn+1vSmPaiJE0CrxDe7jiMq4UXfwfPcBwaoX9Y4pQUIMDsCFRCpdoLX4d
WNUIl00cBEgdBd/ORuUt9Br3pK+PXjFwf7XrK3VjGojRJnisJ4c3bTRl/mO2DGmY
A9OOsljNoYEfLULhtnmb8yV6ZzUbgaynFuQsbcm+pYIhZHY3AikoGfjyYol7Ifny
fJdttUUA0kgWvMVqRCtG3fYBS/o2BPoigRZk8KRsSKfUsCKXDjJ/Z0QsSBzVJey9
zr/NElvJE4E/vMqnP/F4cB/vileAJ/V5d+zSKjC2R+ARdDizxNDoOpnPUAXlzP8U
PBsSgZFHIRzYUc+cnkpKLYJ28We/tnGVlIyJQ22JztpF/VxhfUlBPtscl2AaG827
b3CCMxSOAktKSgPcMhEI3eMu37foJG1W990VYISzgEb5wjWmBuu+JiHLAQYzCqhx
dr9b4ENrOi+HTq1z/uPIGCry2t1MjoDYOphOmUiSmkqqhgOUsmA=
=wiXV
-----END PGP SIGNATURE-----
pgp82zuhDWD48.pgp
Description: PGP signature
--- End Message ---
