The Elixir protobuf package's decoder recursively processes embedded message fields without limiting recursion depth. For schemas with self-referential or cyclic message types, an attacker can craft protobuf messages that nest embedded fields to extreme depths. Each recursion level consumes stack and heap memory, and since the recursion is not in tail position, frames accumulate until memory exhaustion or scheduler starvation occurs. Unlike reference protobuf implementations that cap recursion at 100 levels, this decoder imposes no such limit, enabling denial of service via resource exhaustion. The fix involves adding a recursion depth counter that raises an error when exceeding a configurable limit (default 100).

This vulnerability enables unauthenticated, network-accessible attackers to cause a denial of service on any service decoding attacker-controlled protobuf messages with self-referential or cyclic schemas. A single crafted request can consume significant CPU time and hundreds of megabytes of memory, and a few concurrent requests can take the node offline by exhausting system resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor advisory describes a fix that adds a recursion depth limit to prevent unbounded recursion. Until a fixed version is released, consider rejecting or limiting deeply nested protobuf messages at the application level if possible.