elixir-protobuf JSON Decoder decode.ex decode_singular recursion

Summaryinfo

A vulnerability, which was classified as problematic, has been found in elixir-protobuf protobuf. This vulnerability affects the function decode_singular of the file lib/protobuf/json/decode.ex of the component JSON Decoder. This manipulation causes recursion. The identification of this vulnerability is CVE-2026-104635. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in elixir-protobuf protobuf (affected version unknown) and classified as problematic. Affected by this vulnerability is the function decode_singular of the file lib/protobuf/json/decode.ex of the component JSON Decoder. The manipulation with an unknown input leads to a recursion vulnerability. The CWE definition for the vulnerability is CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. As an impact it is known to affect availability. The summary by CVE is:

Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 into a schema that contains a self-referential or cyclic message type is affected. In lib/protobuf/json/decode.ex, the embedded-message clause of decode_singular/3 recurses into internal_from_json_data/3 once per nesting level without incrementing or checking the decoder's depth counter. The depth guard increase_depth_and_maybe_throw/1 covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct clauses, so the recursion_limit option has no effect on user-defined message types. Each nesting level allocates a stack frame and heap objects, and a sufficiently deep document exhausts the memory of the decoding process. Confidentiality and integrity are not affected. This issue affects protobuf: from 0.8.0 onward.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-104635 since 10/08/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• elixir-protobuf

Name

• protobuf

Website

• Product: https://github.com/elixir-protobuf/protobuf/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion