CVE-2026-104635

A flaw was found in protobuf. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by submitting a deeply nested JSON document to an application configured to decode self-referential message types. Because the decoder fails to enforce recursion limits on these structures, processing the input exhausts system memory and crashes the application.

A moderate-impact denial of service flaw was found in the JSON decoder of the Elixir protobuf library (elixir-protobuf protobuf, Protobuf.JSON.Decode). An unauthenticated remote attacker can submit a deeply nested JSON document to an application that decodes attacker-supplied JSON into a protobuf schema containing self-referential or cyclic message types. The decoder's depth guard covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct well-known types, so the recursion_limit option does not apply to user-defined message types; decoding recurses once per nesting level and each level allocates a stack frame and heap objects until process memory is exhausted and the decoding process crashes. Confidentiality and integrity are not affected. Red Hat product streams matched to this flaw are currently recorded as affected. Because the Red Hat impact is moderate with a CVSS3 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), below the threshold at which Red Hat files trackers for moderate severity, fixes for in-support Red Hat product streams are deferred; the residual risk is a crash of applications that decode untrusted JSON into self-referential protobuf message types. Community streams such as Fedora and EPEL are delegated, with a fix pursued through those streams, and streams outside full support scope are marked out of support scope. Red Hat's moderate rating differs from the upstream/CVEorg assessment of important (CVSS 4.0 score 8.2) mainly because Red Hat scores exploitation as high attack complexity: successful exploitation requires the target application to use a schema with self-referential or cyclic message types, whereas the CVSS 4.0 vector records this only as an attack prerequisite.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The Protobuf.JSON recursion_limit option does not currently limit recursion for user-defined message types, so no decoder configuration prevents this issue. As an interim mitigation, operators of applications that decode untrusted JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 into self-referential or cyclic message types can bound the accepted request body size and reject or pre-validate the maximum JSON nesting depth at the web server or middleware layer before the document reaches the protobuf decoder. The upstream advisory GHSA-m497-c2h9-rvw6 lists elixir-protobuf protobuf 0.17.1 as the patched release for the affected range (>= 0.8.0, <= 0.17.0); upgrading applications to a version containing the upstream fix resolves the issue.