CVE-2026-54451: Protobuf: Unbounded recursion depth in embedded-message decoding ### Summary Unbounded recursion depth in `Protobuf.Decoder` (Hex package `protobuf`, versions…

high

Protobuf: Unbounded recursion depth in embedded-message decoding

### Summary

Unbounded recursion depth in `Protobuf.Decoder` (Hex package `protobuf`, versions `>= 0.8.0, >` (tag `0x0A` = field 1, wire type 2). Use an iolist with a running byte-size to keep generation O(depth).
3. POST the body (a few MB at `depth = 1_000_000`) as `application/x-protobuf` to any endpoint that calls `Tree.decode/1`.
4. The non-tail `decode(bin, type)` in `value_for_field/3` re-enters once per nesting level, accumulating a frame per level. The decode burns seconds of CPU and hundreds of MB on the victim node; a few concurrent requests exhaust it.

### Impact

Unauthenticated, network-reachable request-amplification denial of service against any service that decodes attacker-influenced protobuf bytes into a self-referential or cyclic message type. A single small request can consume seconds of CPU and hundreds of MB of memory on the victim; a few concurrent requests can take the node offline.

## Resources

* Introduction commit: https://github.com/elixir-protobuf/protobuf/commit/21ec7c5bec4fec74e10c1de0d5d1a2d8152ac5d4
* Patch commit: https://github.com/elixir-protobuf/protobuf/commit/b8efa97790eece3d2d0e8e7c31a45ed409fe5338

Affected

1 ranges

Vendor	Product	Version range	Fixed in
google	protobuf	>= 0.8.0 < 0.16.1	0.16.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.