CVE-2026-104635: Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages
Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.fromdecoded/3 into a schema that contains a self-referential or cyclic message type is affected.
In lib/protobuf/json/decode.ex, the embedded-message clause of decodesingular/3 recurses into internalfromjsondata/3 once per nesting level without incrementing or checking the decoder's depth counter. The depth guard increasedepthandmaybethrow/1 covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct clauses, so the recursionlimit option has no effect on user-defined message types. Each nesting level allocates a stack frame and heap objects, and a sufficiently deep document exhausts the memory of the decoding process. Confidentiality and integrity are not affected.
This issue affects protobuf: from 0.8.0 before 0.17.1.
Other sources
Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.fromdecoded/3 into a schema that contains a self-referential or cyclic message type is affected.
In lib/protobuf/json/decode.ex, the embedded-message clause of decodesingular/3 recurses into internalfromjsondata/3 once per nesting level without incrementing or checking the decoder's depth counter. The depth guard increasedepthandmaybethrow/1 covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct clauses, so the recursionlimit option has no effect on user-defined message types. Each nesting level allocates a stack frame and heap objects, and a sufficiently deep document exhausts the memory of the decoding process. Confidentiality and integrity are not affected.
This issue affects protobuf: from 0.8.0 onward.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using protobuf 0.8.0 or later are affected if they decode attacker-supplied JSON through Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 into a schema containing a self-referential or cyclic message type.
What must an attacker send to trigger the crash?
An unauthenticated attacker needs to provide a sufficiently deeply nested JSON document that follows a self-referential or cyclic message structure. Repeated embedded-message decoding consumes stack and heap resources until the decoding process runs out of memory.
Does setting the recursion_limit option mitigate this issue?
No. The recursion_limit option does not apply to user-defined embedded message types in the affected decoding path; its depth guard covers only Google.Protobuf.ListValue and Google.Protobuf.Struct.
What is the security impact?
The impact is denial of service through crashing or exhausting memory in the decoding process. The provided information states that confidentiality and integrity are not affected.