CVE-2026-54451

A flaw was found in Elixir protobuf, a pure Elixir implementation of Google Protobuf. An attacker can craft protobuf messages with a self-referential or cyclic message type. When these messages are decoded by the Protobuf.Decoder component, specifically the valueforfield function, an unbounded...

CVE-2026-54451

Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex,...

CVE-2026-54451 Elixir protobuf: Unbounded recursion depth in embedded-message decoding

Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex,...