{"items":[{"id":"NVI-00016251","kind":"vulnerability","title":"Protobuf: Unbounded recursion depth in embedded-message decoding","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-rv48-qqj5-crxg","CVE-2026-54451"],"plain_summary":"GitHub lists this reviewed advisory for protobuf. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-56845a328d1983eb7c9b6d687d8425f3"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-56845a328d1983eb7c9b6d687d8425f3","url":"https://github.com/advisories/GHSA-rv48-qqj5-crxg","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-rv48-qqj5-crxg","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T09:59:43.724Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-56845a328d1983eb7c9b6d687d8425f3"],"technology":"protobuf","known_exclusions":[],"conditions_summary":"### Summary\n\nUnbounded recursion depth in `Protobuf.Decoder` (Hex package `protobuf`, versions `>= 0.8.0, < 0.16.1`) lets an unauthenticated attacker crash any service that decodes untrusted protobuf messages whose schema contains a self-referential or cyclic message type. A small request body (a few KB to a few MB) that nests an embedded field hundreds of thousands to millions of levels deep forces the BEAM to recurse once per level, exhausting memory and pinning a scheduler. A handful of such requests can take the node offline (a request-amplification denial of service).\n\n### Details\n\n`Protobuf.Decoder.value_for_field/3` handles embedded message fields in its `embedded?: true` branch at `lib/protobuf/decoder.ex:218-243`. For an embedded field it calls `decode(bin, type)` recursively, which re-enters `build_message → handle_value → value_for_field`. The recursive call is not in tail position (its result is consumed by the surrounding decode after it returns), so every nesting level retains a live frame on the process stack and heap.\n\nThere is no recursion-depth counter anywhere in the decoder. For any schema with a self-referential message type (e.g. `message Tree { Tree child = 1","public_affected_ranges":[">= 0.8.0, < 0.16.1"]}],"null_published_at":"2026-11-04T10:04:27.923Z","source_updated_at":"2026-07-15T17:44:29.000Z","source_disclosed_at":"2026-07-15T17:44:28.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T09:59:43.724Z"}],"next_cursor":null,"snapshot_revision":"42594"}