CVE-2026-104635: CWE-674 Uncontrolled Recursion in elixir-protobuf protobuf

The vulnerability exists in the Protobuf.JSON.Decode module of elixir-protobuf, specifically in the decode_singular/3 function's embedded-message clause. This clause recurses into internal_from_json_data/3 for each nesting level without incrementing or checking the decoder's depth counter. The existing depth guard only applies to Google.Protobuf.ListValue and Google.Protobuf.Struct types, so user-defined cyclic message types are not protected by the recursion limit. Consequently, an attacker can cause uncontrolled recursion by crafting deeply nested JSON documents that decode into self-referential or cyclic schemas, leading to stack and heap exhaustion and crashing the decoding process. The issue affects all protobuf versions from 0.8.0 onward.

An unauthenticated remote attacker can cause a denial of service by crashing the decoding process through a crafted deeply nested JSON document. The vulnerability does not affect confidentiality or integrity of data but can disrupt availability of applications using the affected protobuf JSON decoding functions with vulnerable versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid decoding untrusted JSON documents that may contain deeply nested or cyclic message structures using elixir-protobuf protobuf versions 0.8.0 and later.