What is CVE-2026-6409?

CVE-2026-6409 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input

Which CVE IDs does CVE-2026-6409 cover?

CVE-2026-6409 covers the following CVE IDs: CVE-2026-6409. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by CVE-2026-6409?

CVE-2026-6409 affects 5 products, including: azl3 mysql 8.0.45-2 on Azure Linux 3.0; azl3 protobuf 25.3-6 on Azure Linux 3.0; azl3 pytorch 2.2.2-12 on Azure Linux 3.0; cbl2 protobuf 3.17.3-5 on CBL Mariner 2.0; cbl2 protobuf 3.17.3-5 on CBL-Mariner 2.0.

CVE-2026-6409High

Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input

Vendor

Microsoft Security Response Center (MSRC)

Published

June 2, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-6409 →

🎯 Affected products5

azl3 mysql 8.0.45-2 on Azure Linux 3.0
azl3 protobuf 25.3-6 on Azure Linux 3.0
azl3 pytorch 2.2.2-12 on Azure Linux 3.0
cbl2 protobuf 3.17.3-5 on CBL Mariner 2.0
cbl2 protobuf 3.17.3-5 on CBL-Mariner 2.0

✅ Remediation

KBCBL-Mariner Releases (Security Update) — fixed build 25.3-7 KBRelease Notes (Security Update)

🔗 References (2)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-6409
referencehttps://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade