elixir-protobuf protobuf: Uncontrolled recursion in JSON decoding
Summary
The Elixir library protobuf decodes JSON into Protobuf messages. When the target message type is self-referential or cyclic, the JSON decoder recurses once per nesting level without any depth check, because the recursion_limit option only covers the Google.Protobuf.ListValue and Google.Protobuf.Struct types. An unauthenticated attacker who can send JSON to such an endpoint can crash the decoding process or exhaust node memory with a deeply nested document. Confidentiality and integrity are not affected.
Affected
- protobuf from 0.8.0 before 0.17.1 (Hex package)
- Git range b0a1d4e to e9432ad is listed by the CNA as affected; the range is not fully verified
- Exposure requires an application that decodes attacker-controlled JSON with Protobuf.JSON.decode/3, decode!/3 or from_decoded/3 into a self-referential or cyclic message type
Fixed in
- Upgrade to protobuf 0.17.1 or later
Workaround
- Reject JSON documents with a nesting depth above a fixed bound before they reach the decoder, at the web or middleware layer
- Do not rely on the recursion_limit option for user-defined message types, as it has no effect on them
Exploitation
- CISA SSVC: exploitation is at the proof-of-concept level, not automatable
- No reports of exploitation in the wild found; status unknown
- A public proof of concept is not confirmed by the sources
Our recommendation
- Check whether any Elixir or Erlang project uses protobuf (for example in mix.lock) and note the version
- Upgrade every affected project to protobuf 0.17.1 and retest JSON decoding
- If the service is internet-facing and the upgrade is delayed, add a nesting-depth check before the decoder
- Monitor the GitHub advisory and NVD for updates, as NVD status was Deferred at publication
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (CNA EEF) cna.erlef.org
- Fix commit b0a1d4e github.com
- Fix commit e9432ad github.com
- GitHub Security Advisory GHSA-m497-c2h9-rvw6 github.com
- OSV EEF-CVE-2026-104635 osv.dev
- Changelog elixir-protobuf github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:47.
Original description (NVD)
Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 into a schema that contains a self-referential or cyclic message type is affected. In lib/protobuf/json/decode.ex, the embedded-message clause of decode_singular/3 recurses into internal_from_json_data/3 once per nesting level without incrementing or checking the decoder's depth counter. The depth guard increase_depth_and_maybe_throw/1 covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct clauses, so the recursion_limit option has no effect on user-defined message types. Each nesting level allocates a stack frame and heap objects, and a sufficiently deep document exhausts the memory of the decoding process. Confidentiality and integrity are not affected. This issue affects protobuf: from 0.8.0 before 0.17.1.
NVD references (6)
- https://cna.erlef.org/cves/CVE-2026-104635.html
- https://github.com/elixir-protobuf/protobuf/commit/b0a1d4eaffaf50012fa71a8e931a47cf252d0370
- https://github.com/elixir-protobuf/protobuf/commit/e9432ad1c4099511905353cebcececa3a1f7c3ff
- https://github.com/elixir-protobuf/protobuf/security/advisories/GHSA-m497-c2h9-rvw6
- https://osv.dev/vulnerability/EEF-CVE-2026-104635
- https://osv.dev/vulnerability/EEF-CVE-2026-104635
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.