CVE-2026-54451

Name of the Vulnerable Software and Affected Versions Elixir protobuf versions 0.8.0 through 0.16.0

Description Services using Protobuf.Decoder to decode attacker-controlled bytes can be taken offline if the schema contains a self-referential or cyclic message type. The Protobuf.Decoder.value for field/3 function handles embedded fields by recursively entering a call chain involving decode, build message, handle value, and value for field without enforcing a nesting-depth limit. Because these recursive calls are not in tail position, deeply nested embedded fields retain frames on the process stack and heap. This allows a small request to consume substantial CPU and memory, pin a BEAM scheduler, and exhaust the node, resulting in a request-amplification denial of service.

Recommendations Update Elixir protobuf to version 0.16.1.