CVE-2026-54451: Elixir Protobuf uncontrolled recursion in decoder

CVE-2026-54451 · Severity: high · CVSS 8.2 · Published 2026-09-17

A vulnerability in the Elixir Protobuf library allows an unauthenticated attacker to crash services that process specially crafted data. By sending a small but deeply nested message, an attacker can exhaust a server's memory and processing power, leading to a total service outage. This affects any application using this library to decode data formats that allow self-referencing structures, such as comment threads or file trees.

Quick answers

Is CVE-2026-54451 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54451 being exploited in the wild.
How severe is CVE-2026-54451?
High severity, with a CVSS score of 8.2, published 17 September 2026.
Which products and versions are affected?
elixir-protobuf protobuf >= 0.8.0, < 0.16.1.
Is there a fix for CVE-2026-54451?
A patch was published on 2026-07-15: Fix released in version 0.16.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54451 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54451?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the `Protobuf.Decoder.value_for_field/3` function of the Elixir `protobuf` package. When decoding embedded message fields, the decoder performs recursive calls that are not in tail position, causing each nesting level to retain a live frame on the process stack and heap. Because there is no recursion-depth limit, an attacker can provide a payload with hundreds of thousands of nesting levels using a self-referential or cyclic message schema. This results in a request-amplification denial of service (DoS) by exhausting memory or starving the BEAM scheduler. The issue is resolved in version 0.16.1 by introducing a configurable recursion limit (defaulting to 100).

Affected products

  • elixir-protobuf protobuf >= 0.8.0, < 0.16.1

Identifiers

  • CVE-2026-54451
  • GHSA-rv48-qqj5-crxg

Timeline

  • 2026-06-04: disclosed: Initial disclosure to the maintainers
  • 2026-07-15: advisory: GitHub Advisory published
  • 2026-07-15: patched: Fix released in version 0.16.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.