CVE-2026-104635

A moderate-impact denial of service flaw was found in the JSON decoder of the Elixir protobuf library (elixir-protobuf protobuf, Protobuf.JSON.Decode). An unauthenticated remote attacker can submit a deeply nested JSON document to an application that decodes attacker-supplied JSON into a protobuf schema containing self-referential or cyclic message types. The decoder's depth guard covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct well-known types, so the recursion_limit option does not apply to user-defined message types; decoding recurses once per nesting level and each level allocates a stack frame and heap objects until process memory is exhausted and the decoding process crashes. Confidentiality and integrity are not affected. Red Hat product streams matched to this flaw are currently recorded as affected. Because the Red Hat impact is moderate with a CVSS3 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), below the threshold at which Red Hat files trackers for moderate severity, fixes for in-support Red Hat product streams are deferred; the residual risk is a crash of applications that decode untrusted JSON into self-referential protobuf message types. Community streams such as Fedora and EPEL are delegated, with a fix pursued through those streams, and streams outside full support scope are marked out of support scope. Red Hat's moderate rating differs from the upstream/CVEorg assessment of important (CVSS 4.0 score 8.2) mainly because Red Hat scores exploitation as high attack complexity: successful exploitation requires the target application to use a schema with self-referential or cyclic message types, whereas the CVSS 4.0 vector records this only as an attack prerequisite.