CVE-2026-54451

Overview

The Elixir protobuf library contains a denial of service vulnerability in its decoding logic for self-referential or cyclic message types. Attackers can send specially crafted payloads to trigger unbounded recursion during decoding. This consumes excessive CPU and memory resources, leading to node exhaustion.

Description

Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex, Protobuf.Decoder.value_for_field/3 handles an embedded?: true field by recursively entering the decode / build_message / handle_value / value_for_field call chain without enforcing a nesting-depth limit. Deeply nested embedded fields retain non-tail recursive frames, allowing a comparatively small request to consume substantial CPU and memory, pin a BEAM scheduler, and exhaust the node. This issue is fixed in version 0.16.1.

Impact

This vulnerability impacts availability by allowing unauthenticated remote attackers to crash services processing untrusted protobuf data. Confidentiality and integrity are not directly affected. The crash impacts Erlang VM (BEAM) schedulers, potentially bringing down the entire node.

Remediation

Upgrade the Elixir protobuf dependency to version 0.16.1 or later. Ensure input validation is applied to all incoming protobuf payloads where possible. Monitor application resource usage to detect anomalous CPU and memory spikes associated with decoding.

Risk context

Rated as high severity with a CVSS v4 score of 8.2, this vulnerability requires immediate attention for applications processing untrusted protobuf streams. Although EPSS data is not currently available, the ease of triggering service exhaustion makes prompt patching critical.

Affected products

• Elixir protobuf (0.8.0 to 0.16.0)