CVE-2026-54451: Protobuf Package Suffers from Unbounded Recursion Depth in Embedded-Message Decoding

protobuf Updated 16 Jul 2026

Summary

15/07/2026

Disclosed on

CVE-2026-54451

CVE

Yes i

Fix available

High

Severity

8.2

CVSS Score

CVE-2026-54451: Protobuf: Unbounded recursion depth in embedded-message decoding. Affects protobuf versions >= 0.8.0, < 0.16.1. Fixed in 0.16.1. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The Protobuf package, utilized in Elixir for encoding and decoding structured data, allows developers to define message schemas and serialize data efficiently. However, versions from 0.8.0 to 0.16.0 are vulnerable to a critical issue where untrusted protobuf messages can lead to unbounded recursion, causing denial of service. This vulnerability arises from the lack of a recursion depth limit during the decoding of self-referential or cyclic message types.

Vulnerability Detail

The vulnerability in the Protobuf package stems from the Protobuf.Decoder.value_for_field/3 function, which handles embedded message fields recursively without a depth counter. This allows an attacker to craft a small request body that, when decoded, can nest hundreds of thousands to millions of levels deep. As each level of recursion consumes memory and CPU, a few such requests can crash the service, leading to a denial of service. The absence of a recursion limit means that the process can exhaust memory, blow the stack, or starve the scheduler, making it highly exploitable.

How To Fix

Minimum fixed version

0.16.1

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary workaround, you can implement input validation to reject protobuf messages that contain self-referential or cyclic structures. However, this is not a complete solution and should only be used until the package is updated.

Conclusion

The unbounded recursion vulnerability in the Protobuf package poses a significant risk to services that decode untrusted protobuf messages. It is crucial to update to the patched version to mitigate this risk and ensure the stability of your applications.

See every vulnerability recorded for protobuf →