CVE-2026-54451: Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protob

Executive brief

A vulnerability in the Elixir Protobuf library allows an unauthenticated attacker to crash services that process specially crafted data. By sending a small but deeply nested message, an attacker can exhaust a server's memory and processing power, leading to a total service outage. This affects any application using this library to decode data formats that allow self-referencing structures, such as comment threads or file trees.

Technical details

The vulnerability exists in the `Protobuf.Decoder.value_for_field/3` function of the Elixir `protobuf` package. When decoding embedded message fields, the decoder performs recursive calls that are not in tail position, causing each nesting level to retain a live frame on the process stack and heap. Because there is no recursion-depth limit, an attacker can provide a payload with hundreds of thousands of nesting levels using a self-referential or cyclic message schema. This results in a request-amplification denial of service (DoS) by exhausting memory or starving the BEAM scheduler. The issue is resolved in version 0.16.1 by introducing a configurable recursion limit (defaulting to 100).

Affected products

• elixir-protobuf protobuf >= 0.8.0, < 0.16.1

Timeline

• 2026-06-04: disclosed: Initial disclosure to the maintainers
• 2026-07-15: advisory: GitHub Advisory published
• 2026-07-15: patched: Fix released in version 0.16.1

References

• https://api.github.com/users/PJUllrich
• https://github.com/PJUllrich
• https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D
• https://api.github.com/users/PJUllrich/repos
• https://avatars.githubusercontent.com/u/10426523?v=4
• https://api.github.com/users/PJUllrich/events%7B/privacy%7D