CVE-2026-54451
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
In the Elixir protobuf library from 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes can be taken offline when the schema contains a self-referential or cyclic message type. The decoder recursively processes nested embedded fields without a nesting-depth limit, allowing a relatively small request to consume substantial CPU and memory and pin a BEAM scheduler. The issue is fixed in 0.16.1.
Risk Assessment
An attacker can cause resource exhaustion and service unavailability (denial of service) by sending specially crafted protobuf data. This can pin a BEAM scheduler and render the entire node unresponsive.
Recommendation
Update the Elixir protobuf library to version 0.16.1 or later. Consider limiting the size and nesting depth of processed protobuf messages at the application level.
Other vulnerabilities in Elixir protobuf
Original NVD description (English source)
Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex, Protobuf.Decoder.value_for_field/3 handles an embedded?: true field by recursively entering the decode / build_message / handle_value / value_for_field call chain without enforcing a nesting-depth limit. Deeply nested embedded fields retain non-tail recursive frames, allowing a comparatively small request to consume substantial CPU and memory, pin a BEAM scheduler, and exhaust the node. This issue is fixed in version 0.16.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS