Elixir: From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains… (CVE-2026-54451)
Description
Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex, Protobuf.Decoder.value_for_field/3 handles an embedded?: true field by recursively entering the decode / build_message / handle_value / value_for_field call chain without enforcing a nesting-depth limit. Deeply nested embedded fields retain non-tail recursive frames, allowing a comparatively small request to consume substantial CPU and memory, pin a BEAM scheduler, and exhaust the node. This issue is fixed in version 0.16.1.
CVSS v4.0
Affected software
pkg:deb/ubuntu/elixir?arch=source&distro=trustypkg:deb/ubuntu/elixir?arch=source&distro=xenialpkg:deb/ubuntu/elixir?arch=source&distro=bionicRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Elixir protobuf (versions >=0.8.0 <0.16.1) arises from the Protobuf.Decoder.value_for_field/3 function handling embedded fields recursively without enforcing a limit on nesting depth. When decoding protobuf messages with self-referential or cyclic types controlled by an attacker, this leads to deep recursion with non-tail calls, causing high CPU and memory consumption, scheduler pinning, and node exhaustion. This denial-of-service condition is resolved in version 0.16.1.
Potential Impact
An attacker can send specially crafted protobuf messages that cause the decoder to recurse deeply, consuming substantial CPU and memory resources. This can pin a BEAM scheduler and exhaust the node, effectively taking the service offline. No information about data confidentiality or integrity impact is provided.
Mitigation Recommendations
Upgrade Elixir protobuf to version 0.16.1 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-rv48-qqj5-crxg
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-54451"]
- Ecosystems
- ["Hex"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a58b50768715ace43db2994
Added to database: 07/16/2026, 10:40:07 UTC
Last enriched: 09/25/2026, 01:59:36 UTC
Last updated: 10/16/2026, 18:48:22 UTC
Views: 391
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.