CVE-2026-104635
Published: October 9th, 2026
Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 into a schema that contains a self-referential or cyclic message type is affected.
In lib/protobuf/json/decode.ex, the embedded-message clause of decode_singular/3 recurses into internal_from_json_data/3 once per nesting level without incrementing or checking the decoder's depth counter. The depth guard increase_depth_and_maybe_throw/1 covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct clauses, so the recursion_limit option has no effect on user-defined message types. Each nesting level allocates a stack frame and heap objects, and a sufficiently deep document exhausts the memory of the decoding process. Confidentiality and integrity are not affected.
This issue affects protobuf: from 0.8.0 before 0.17.1.
Unknown
CVSS v2:
CVSS v2:
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| daily | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 26.3 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 26.2 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 26.1 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 25.4 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 25.3 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 25.2 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 25.1 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 24.4 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 24.4.0 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 24.3 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 24.2 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 24.1 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 23.3 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 23.2 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 23.1 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 22.4 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 22.3 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 22.2 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 22.1 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 21.11 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 21.8 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 21.5.0 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 21.2.0 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 11.4.19.3667 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 11.4.18.3599 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 11.4.16.3445 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 11.4.15.3368 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 11.4.14.3263 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 11.4.13.3179 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 11.4.12.3054 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 11.4.11.3040 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 11.4.11.2990 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 11.4.10.2934 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 11.4.9.2878 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. | |
| 11.4.8.2822 | protobuf (3.0.0) | False Positive | The flaw is in the elixir-protobuf project, an Elixir library. Document Filters uses Google’s C++ Protocol Buffers, which is unrelated. |