{"id":"CVE-2026-104635","summary":"Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages","details":"Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 into a schema that contains a self-referential or cyclic message type is affected.\n\nIn lib/protobuf/json/decode.ex, the embedded-message clause of decode_singular/3 recurses into internal_from_json_data/3 once per nesting level without incrementing or checking the decoder's depth counter. The depth guard increase_depth_and_maybe_throw/1 covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct clauses, so the recursion_limit option has no effect on user-defined message types. Each nesting level allocates a stack frame and heap objects, and a sufficiently deep document exhausts the memory of the decoding process. Confidentiality and integrity are not affected.\n\nThis issue affects protobuf: from 0.8.0 before 0.17.1.","aliases":["EEF-CVE-2026-104635","GHSA-m497-c2h9-rvw6"],"modified":"2026-10-11T02:46:19.072407785Z","published":"2026-10-09T08:17:52.372Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104635.json","cna_assigner":"EEF","cwe_ids":["CWE-674"]},"references":[{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-104635.html"},{"type":"WEB","url":"https://github.com"},{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-104635"},{"type":"WEB","url":"https://repo.hex.pm"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104635.json"},{"type":"ADVISORY","url":"https://github.com/elixir-protobuf/protobuf/security/advisories/GHSA-m497-c2h9-rvw6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104635"},{"type":"FIX","url":"https://github.com/elixir-protobuf/protobuf/commit/b0a1d4eaffaf50012fa71a8e931a47cf252d0370"},{"type":"FIX","url":"https://github.com/elixir-protobuf/protobuf/commit/e9432ad1c4099511905353cebcececa3a1f7c3ff"},{"type":"PACKAGE","url":"https://github.com/elixir-protobuf/protobuf"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elixir-protobuf/protobuf","events":[{"introduced":"b0a1d4eaffaf50012fa71a8e931a47cf252d0370"},{"fixed":"e9432ad1c4099511905353cebcececa3a1f7c3ff"},{"introduced":"3b251d286dc94745fc6a92fcbf9be03f44bb9b46"},{"fixed":"91c20c8fb2c1a6e2c13cf3470f61f09b962cf708"}],"database_specific":{"extracted_events":[{"introduced":"0.8.0"},{"fixed":"0.17.1"}],"source":"AFFECTED_FIELD"}}],"versions":["v0.17.0","v0.16.0","v0.15.0","v0.14.1","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.0","v0.9.0","v0.8.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104635.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}