EUVD-2026-95562Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated, no user interaction; AC:H because exploitation requires the target to use a cyclic message schema; availability-only impact (A:H), no C/I.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
4DescriptionCVE.org
Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 into a schema that contains a self-referential or cyclic message type is affected.
In lib/protobuf/json/decode.ex, the embedded-message clause of decode_singular/3 recurses into internal_from_json_data/3 once per nesting level without incrementing or checking the decoder's depth counter. The depth guard increase_depth_and_maybe_throw/1 covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct clauses, so the recursion_limit option has no effect on user-defined message types. Each nesting level allocates a stack frame and heap objects, and a sufficiently deep document exhausts the memory of the decoding process. Confidentiality and integrity are not affected.
This issue affects protobuf: from 0.8.0 onward.
AnalysisAI
Memory-exhaustion denial of service in the elixir-protobuf library (protobuf) from 0.8.0 onward allows an unauthenticated remote attacker to crash an Elixir decoding process by supplying a deeply nested JSON document through Protobuf.JSON.decode/3, decode!/3, or from_decoded/3 when the target schema contains a self-referential or cyclic message type. Because the embedded-message clause of decode_singular/3 recurses once per nesting level without touching the decoder's depth counter, the recursion_limit option offers no protection and each level consumes a stack frame plus heap objects until the process runs out of memory; confidentiality and integrity are unaffected, only availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable only when an application decodes attacker-supplied JSON via Protobuf.JSON.decode/3, decode!/3, or from_decoded/3 into a Protobuf schema that contains a self-referential or cyclic (recursive) message type; the embedded-message clause of decode_singular/3 recurses without incrementing the depth counter, and the recursion_limit option provides no protection because the depth guard (increase_depth_and_maybe_throw/1) only covers Google.Protobuf.ListValue and Google.Protobuf.Struct. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine denial-of-service exposure, but one whose real-world priority is bounded by preconditions rather than its 8.2 CVSS 4.0 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - the corrected code is in commit https://github.com/elixir-protobuf/protobuf/commit/b0a1d4eaffaf50012fa71a8e931a47cf252d0370, so operators should upgrade to the first tagged release of the protobuf package that contains it and track the advisory https://github.com/elixir-protobuf/protobuf/security/advisories/GHSA-m497-c2h9-rvw6 for the exact version number rather than guessing. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications using elixir-protobuf version 0.8.0 or later and determine if they decode untrusted JSON into schemas containing self-referential or cyclic message types; for any such exposed service, immediately disable JSON decoding from untrusted sources or enforce a strict application-level nesting depth limit (e.g., reject JSON deeper than 10 levels) and monitor memory usage for abnormal spikes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unbounded recursion in the Elixir `protobuf` Hex package (versions >= 0.8.0, < 0.16.1) lets unauthenticated remote attac
Improper JWT signature verification in Dashbit's nimble_zta (0.1.2 up to but not including 0.1.3) lets an unauthenticate
Session-swapping authentication bypass in the Elixir library AshAuthentication (versions 4.10.0 before 4.15.0 and 5.0.0-
Authentication bypass in the Elixir library ash_authentication lets an attacker who operates one federated identity-prov
Account takeover in AshAuthentication (Elixir/Ash) 4.14.0 through 4.14.x and 5.0.0-rc.10 through 5.0.0-rc.13 lets unauth
Server-Side Request Forgery protection bypass in the Elixir safeurl library (versions 0.1.0 and later) allows unauthenti
Atom table exhaustion in the Ash framework (Elixir) allows an unauthenticated remote attacker to crash a BEAM node by su
Ciphertext tampering in the Cloak Elixir encryption library (danielberkompas/cloak, all versions from 0.1.0-pre onward)
Memory exhaustion denial-of-service in Elixir Mint affects versions 1.1.0 through 1.10.x and allows a malicious or compr
Authentication bypass in the AshAuthentication library for Elixir/Ash lets an authenticated attacker who holds a valid s
An authenticated account-takeover primitive exists in the Elixir library AshAuthentication (ash_authentication) versions
Session fixation in the Elixir/Phoenix authentication library ash_authentication (0.2.0 before 4.15.0, and 5.0.0-rc.0 be
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today