CVE-2026-104635: Uncontrolled Recursion in elixir-protobuf Package JSON Decoding

Background

The elixir-protobuf package is a library for encoding and decoding Protocol Buffers (protobuf) in Elixir applications. It allows developers to serialize structured data efficiently. However, this package is vulnerable to an uncontrolled recursion issue during JSON decoding, particularly when handling self-referential message types, which can lead to significant memory exhaustion and application crashes.

Vulnerability Detail

The vulnerability arises from the Protobuf.JSON.Decode module, which fails to guard against uncontrolled recursion when decoding deeply nested JSON documents. Specifically, the decoding process does not properly track the depth of recursion for user-defined message types, allowing an attacker to craft a JSON document that can recursively reference itself. This can lead to stack and heap exhaustion, causing the decoding process to crash. The vulnerability affects versions of the protobuf package from 0.8.0 to below 0.17.1, and it can be exploited by unauthenticated remote attackers.

Workaround

As a temporary workaround, reject JSON documents with a nesting depth that exceeds a predefined limit at the web or middleware layer before passing them to the decoder. For example, you can implement a check like this in your application:

def validate_json_depth(json, max_depth) do
  depth = calculate_depth(json)
  if depth > max_depth do
    {:error, :depth_exceeded}
  else
    :ok
  end
end

defp calculate_depth(value, depth \ 0) do
  case value do
    %{} ->
      Enum.reduce(value, depth + 1, fn {_key, val}, acc ->
        calculate_depth(val, acc)
      end)
    _ ->
      depth
  end
end

Conclusion

CVE-2026-104635 represents a significant risk for applications using the elixir-protobuf package due to uncontrolled recursion during JSON decoding. It is crucial to update to the patched version or implement workarounds to mitigate the risk of application crashes.

See every vulnerability recorded for protobuf →

FAQ