Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-09T08:17:52 protobuf: protobuf: Denial of Service via deeply nested JSON input 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 into a schema that contains a self-referential or cyclic message type is affected. In lib/protobuf/json/decode.ex, the embedded-message clause of decode_singular/3 recurses into internal_from_json_data/3 once per nesting level without incrementing or checking the decoder's depth counter. The depth guard increase_depth_and_maybe_throw/1 covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct clauses, so the recursion_limit option has no effect on user-defined message types. Each nesting level allocates a stack frame and heap objects, and a sufficiently deep document exhausts the memory of the decoding process. Confidentiality and integrity are not affected. This issue affects protobuf: from 0.8.0 before 0.17.1.

A flaw was found in protobuf. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by submitting a deeply nested JSON document to an application configured to decode self-referential message types. Because the decoder fails to enforce recursion limits on these structures, processing the input exhausts system memory and crashes the application.

A moderate-impact denial of service flaw was found in the JSON decoder of the Elixir protobuf library (elixir-protobuf protobuf, Protobuf.JSON.Decode). An unauthenticated remote attacker can submit a deeply nested JSON document to an application that decodes attacker-supplied JSON into a protobuf schema containing self-referential or cyclic message types. The decoder's depth guard covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct well-known types, so the recursion_limit option does not apply to user-defined message types; decoding recurses once per nesting level and each level allocates a stack frame and heap objects until process memory is exhausted and the decoding process crashes. Confidentiality and integrity are not affected. Red Hat product streams matched to this flaw are currently recorded as affected. Because the Red Hat impact is moderate with a CVSS3 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), below the threshold at which Red Hat files trackers for moderate severity, fixes for in-support Red Hat product streams are deferred; the residual risk is a crash of applications that decode untrusted JSON into self-referential protobuf message types. Community streams such as Fedora and EPEL are delegated, with a fix pursued through those streams, and streams outside full support scope are marked out of support scope. Red Hat's moderate rating differs from the upstream/CVEorg assessment of important (CVSS 4.0 score 8.2) mainly because Red Hat scores exploitation as high attack complexity: successful exploitation requires the target application to use a schema with self-referential or cyclic message types, whereas the CVSS 4.0 vector records this only as an attack prerequisite. The Protobuf.JSON recursion_limit option does not currently limit recursion for user-defined message types, so no decoder configuration prevents this issue. As an interim mitigation, operators of applications that decode untrusted JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 into self-referential or cyclic message types can bound the accepted request body size and reject or pre-validate the maximum JSON nesting depth at the web server or middleware layer before the document reaches the protobuf decoder. The upstream advisory GHSA-m497-c2h9-rvw6 lists elixir-protobuf protobuf 0.17.1 as the patched release for the affected range (>= 0.8.0, <= 0.17.0); upgrading applications to a version containing the upstream fix resolves the issue. OpenShift Service Mesh 3 Fix deferred istio-proxy Red Hat AMQ Clients Fix deferred protobuf Red Hat Ansible Automation Platform 2 Out of support scope python-protobuf Red Hat Ceph Storage 9 Fix deferred protobuf Red Hat Enterprise Linux 10 Fix deferred protobuf Red Hat Enterprise Linux 7 Fix deferred protobuf Red Hat Enterprise Linux 8 Fix deferred protobuf Red Hat Enterprise Linux 9 Fix deferred protobuf Red Hat Hardened Images Not affected protobuf Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 Fix deferred openshift/ose-rhel-coreos-9 Red Hat OpenStack Platform 16.2 Out of support scope protobuf Red Hat Satellite 6 Fix deferred python-protobuf Red Hat Satellite 6 Fix deferred satellite:el8/python-protobuf Red Hat Update Infrastructure 4 for Cloud Providers Out of support scope python-protobuf https://www.cve.org/CVERecord?id=CVE-2026-104635 https://nvd.nist.gov/vuln/detail/CVE-2026-104635 https://cna.erlef.org/cves/CVE-2026-104635.html https://github.com/elixir-protobuf/protobuf/commit/b0a1d4eaffaf50012fa71a8e931a47cf252d0370 https://github.com/elixir-protobuf/protobuf/security/advisories/GHSA-m497-c2h9-rvw6 https://osv.dev/vulnerability/EEF-CVE-2026-104635