Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages
Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 into a schema that contains a self-referential or cyclic message type is affected. In lib/protobuf/json/decode.ex, the embedded-message clause of decode_singular/3 recurses into internal_from_json_data/3 once per nesting level without incrementing or checking the decoder's depth counter. The depth guard increase_depth_and_maybe_throw/1 covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct clauses, so the recursion_limit option has no effect on user-defined message types. Each nesting level allocates a stack frame and heap objects, and a sufficiently deep document exhausts the memory of the decoding process. Confidentiality and integrity are not affected. This issue affects protobuf: from 0.8.0 before 0.17.1.
CVE-2026-104635
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-104635
protobuf
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
protobuf
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:elixir-protobuf:protobuf:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/elixir-protobuf/protobuf",
"vendor": "elixir-protobuf",
"modules": [
"'Elixir.Protobuf.JSON.Decode'",
"'Elixir.Protobuf.JSON'"
],
"product": "protobuf",
"versions": [
{
"status": "affected",
"version": "0.8.0",
"lessThan": "0.17.1",
"versionType": "semver"
}
],
"packageURL": "pkg:hex/protobuf",
"packageName": "protobuf",
"programFiles": [
"lib/protobuf/json/decode.ex",
"lib/protobuf/json.ex"
],
"collectionURL": "https://repo.hex.pm",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.Protobuf.JSON.Decode':from_json_data/3"
},
{
"name": "'Elixir.Protobuf.JSON.Decode':decode_singular/3"
},
{
"name": "'Elixir.Protobuf.JSON':decode/3"
},
{
"name": "'Elixir.Protobuf.JSON':decode!/3"
},
{
"name": "'Elixir.Protobuf.JSON':from_decoded/3"
}
]
},
{
"cpes": [
"cpe:2.3:a:elixir-protobuf:protobuf:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/elixir-protobuf/protobuf",
"vendor": "elixir-protobuf",
"modules": [
"'Elixir.Protobuf.JSON.Decode'",
"'Elixir.Protobuf.JSON'"
],
"product": "protobuf",
"versions": [
{
"status": "affected",
"version": "b0a1d4eaffaf50012fa71a8e931a47cf252d0370",
"lessThan": "e9432ad1c4099511905353cebcececa3a1f7c3ff",
"versionType": "git"
}
],
"packageURL": "pkg:github/elixir-protobuf/protobuf",
"packageName": "elixir-protobuf/protobuf",
"programFiles": [
"lib/protobuf/json/decode.ex",
"lib/protobuf/json.ex"
],
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.Protobuf.JSON.Decode':from_json_data/3"
},
{
"name": "'Elixir.Protobuf.JSON.Decode':decode_singular/3"
},
{
"name": "'Elixir.Protobuf.JSON':decode/3"
},
{
"name": "'Elixir.Protobuf.JSON':decode!/3"
},
{
"name": "'Elixir.Protobuf.JSON':from_decoded/3"
}
]
}
]- Related CVEs
- CVE-2026-104635
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #29195 · Revision 1
- Added to Heist Feed
- Publisher date