{"id":"CVE-2026-54451","summary":"Elixir protobuf: Unbounded recursion depth in embedded-message decoding","details":"Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex, Protobuf.Decoder.value_for_field/3 handles an embedded?: true field by recursively entering the decode / build_message / handle_value / value_for_field call chain without enforcing a nesting-depth limit. Deeply nested embedded fields retain non-tail recursive frames, allowing a comparatively small request to consume substantial CPU and memory, pin a BEAM scheduler, and exhaust the node. This issue is fixed in version 0.16.1.","aliases":["GHSA-rv48-qqj5-crxg"],"modified":"2026-09-19T03:45:50.922617791Z","published":"2026-09-17T18:19:25.334Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-674"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54451.json"},"references":[{"type":"WEB","url":"https://github.com/elixir-protobuf/protobuf/releases/tag/v0.16.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54451.json"},{"type":"ADVISORY","url":"https://github.com/elixir-protobuf/protobuf/security/advisories/GHSA-rv48-qqj5-crxg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54451"},{"type":"FIX","url":"https://github.com/elixir-protobuf/protobuf/commit/352d1769a0ef575a8d18c3f9620609efdb73e2bc"},{"type":"FIX","url":"https://github.com/elixir-protobuf/protobuf/commit/b8efa97790eece3d2d0e8e7c31a45ed409fe5338"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elixir-protobuf/protobuf","events":[{"introduced":"3b251d286dc94745fc6a92fcbf9be03f44bb9b46"},{"fixed":"352d1769a0ef575a8d18c3f9620609efdb73e2bc"},{"fixed":"b8efa97790eece3d2d0e8e7c31a45ed409fe5338"},{"fixed":"786ba702dab5d7263691db57a972b0bb7330606e"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0.8.0"},{"fixed":"0.16.1"}]}}],"versions":["v0.16.0","v0.15.0","v0.14.1","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.0","v0.9.0","v0.8.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54451.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}