protobuf
A pure Elixir implementation of Google Protobuf.
View on Github
Activity
- Latest release
- 3mo ago
- Total releases
- 32
- Cadence
- ~2 months
- Last 12 months
- 3
Reach
- Stars
- —
Details
- License
- MIT
- First release
- May 26, 2017
| Version | Released | |
|---|---|---|
0.17.0
minor
| ||
0.16.1
patch
| ||
0.16.0
minor
1 CVE
CVE-2026-54451
GHSA-rv48-qqj5-crxg
Jul 15, 2026
Protobuf: Unbounded recursion depth in embedded-message decoding
High
Network
Low
None
None
SummaryUnbounded recursion depth in Details
There is no recursion-depth counter anywhere in the decoder. For any schema with a self-referential message type (e.g. Reference protobuf implementations (Google's C++, Java, etc.) cap recursion at 100 specifically to prevent this. The Elixir decoder enforces no comparable bound, so the recursion continues until the process exhausts memory, blows the stack, or starves the scheduler doing GC over the deep structure. The fix threads a depth counter through PoC
ImpactUnauthenticated, network-reachable request-amplification denial of service against any service that decodes attacker-influenced protobuf bytes into a self-referential or cyclic message type. A single small request can consume seconds of CPU and hundreds of MB of memory on the victim; a few concurrent requests can take the node offline. Resources
Affected versions
0.10.0
0.11.0
0.12.0
0.13.0
0.14.0
0.14.1
0.15.0
0.16.0
0.8.0
0.9.0
Fixed in
0.16.1
References
Updated Jul 15, 2026 · Source: OSV.dev | ||
0.15.0
minor
1 CVE
CVE-2026-54451
GHSA-rv48-qqj5-crxg
Jul 15, 2026
Protobuf: Unbounded recursion depth in embedded-message decoding
High
Network
Low
None
None
SummaryUnbounded recursion depth in Details
There is no recursion-depth counter anywhere in the decoder. For any schema with a self-referential message type (e.g. Reference protobuf implementations (Google's C++, Java, etc.) cap recursion at 100 specifically to prevent this. The Elixir decoder enforces no comparable bound, so the recursion continues until the process exhausts memory, blows the stack, or starves the scheduler doing GC over the deep structure. The fix threads a depth counter through PoC
ImpactUnauthenticated, network-reachable request-amplification denial of service against any service that decodes attacker-influenced protobuf bytes into a self-referential or cyclic message type. A single small request can consume seconds of CPU and hundreds of MB of memory on the victim; a few concurrent requests can take the node offline. Resources
Affected versions
0.10.0
0.11.0
0.12.0
0.13.0
0.14.0
0.14.1
0.15.0
0.16.0
0.8.0
0.9.0
Fixed in
0.16.1
References
Updated Jul 15, 2026 · Source: OSV.dev | ||
0.14.1
patch
1 CVE
CVE-2026-54451
GHSA-rv48-qqj5-crxg
Jul 15, 2026
Protobuf: Unbounded recursion depth in embedded-message decoding
High
Network
Low
None
None
SummaryUnbounded recursion depth in Details
There is no recursion-depth counter anywhere in the decoder. For any schema with a self-referential message type (e.g. Reference protobuf implementations (Google's C++, Java, etc.) cap recursion at 100 specifically to prevent this. The Elixir decoder enforces no comparable bound, so the recursion continues until the process exhausts memory, blows the stack, or starves the scheduler doing GC over the deep structure. The fix threads a depth counter through PoC
ImpactUnauthenticated, network-reachable request-amplification denial of service against any service that decodes attacker-influenced protobuf bytes into a self-referential or cyclic message type. A single small request can consume seconds of CPU and hundreds of MB of memory on the victim; a few concurrent requests can take the node offline. Resources
Affected versions
0.10.0
0.11.0
0.12.0
0.13.0
0.14.0
0.14.1
0.15.0
0.16.0
0.8.0
0.9.0
Fixed in
0.16.1
References
Updated Jul 15, 2026 · Source: OSV.dev | ||
0.14.0
minor
1 CVE
CVE-2026-54451
GHSA-rv48-qqj5-crxg
Jul 15, 2026
Protobuf: Unbounded recursion depth in embedded-message decoding
High
Network
Low
None
None
SummaryUnbounded recursion depth in Details
There is no recursion-depth counter anywhere in the decoder. For any schema with a self-referential message type (e.g. Reference protobuf implementations (Google's C++, Java, etc.) cap recursion at 100 specifically to prevent this. The Elixir decoder enforces no comparable bound, so the recursion continues until the process exhausts memory, blows the stack, or starves the scheduler doing GC over the deep structure. The fix threads a depth counter through PoC
ImpactUnauthenticated, network-reachable request-amplification denial of service against any service that decodes attacker-influenced protobuf bytes into a self-referential or cyclic message type. A single small request can consume seconds of CPU and hundreds of MB of memory on the victim; a few concurrent requests can take the node offline. Resources
Affected versions
0.10.0
0.11.0
0.12.0
0.13.0
0.14.0
0.14.1
0.15.0
0.16.0
0.8.0
0.9.0
Fixed in
0.16.1
References
Updated Jul 15, 2026 · Source: OSV.dev | ||
0.13.0
minor
1 CVE
CVE-2026-54451
GHSA-rv48-qqj5-crxg
Jul 15, 2026
Protobuf: Unbounded recursion depth in embedded-message decoding
High
Network
Low
None
None
SummaryUnbounded recursion depth in Details
There is no recursion-depth counter anywhere in the decoder. For any schema with a self-referential message type (e.g. Reference protobuf implementations (Google's C++, Java, etc.) cap recursion at 100 specifically to prevent this. The Elixir decoder enforces no comparable bound, so the recursion continues until the process exhausts memory, blows the stack, or starves the scheduler doing GC over the deep structure. The fix threads a depth counter through PoC
ImpactUnauthenticated, network-reachable request-amplification denial of service against any service that decodes attacker-influenced protobuf bytes into a self-referential or cyclic message type. A single small request can consume seconds of CPU and hundreds of MB of memory on the victim; a few concurrent requests can take the node offline. Resources
Affected versions
0.10.0
0.11.0
0.12.0
0.13.0
0.14.0
0.14.1
0.15.0
0.16.0
0.8.0
0.9.0
Fixed in
0.16.1
References
Updated Jul 15, 2026 · Source: OSV.dev | ||
0.12.0
minor
1 CVE
CVE-2026-54451
GHSA-rv48-qqj5-crxg
Jul 15, 2026
Protobuf: Unbounded recursion depth in embedded-message decoding
High
Network
Low
None
None
SummaryUnbounded recursion depth in Details
There is no recursion-depth counter anywhere in the decoder. For any schema with a self-referential message type (e.g. Reference protobuf implementations (Google's C++, Java, etc.) cap recursion at 100 specifically to prevent this. The Elixir decoder enforces no comparable bound, so the recursion continues until the process exhausts memory, blows the stack, or starves the scheduler doing GC over the deep structure. The fix threads a depth counter through PoC
ImpactUnauthenticated, network-reachable request-amplification denial of service against any service that decodes attacker-influenced protobuf bytes into a self-referential or cyclic message type. A single small request can consume seconds of CPU and hundreds of MB of memory on the victim; a few concurrent requests can take the node offline. Resources
Affected versions
0.10.0
0.11.0
0.12.0
0.13.0
0.14.0
0.14.1
0.15.0
0.16.0
0.8.0
0.9.0
Fixed in
0.16.1
References
Updated Jul 15, 2026 · Source: OSV.dev | ||
0.11.0
minor
1 CVE
CVE-2026-54451
GHSA-rv48-qqj5-crxg
Jul 15, 2026
Protobuf: Unbounded recursion depth in embedded-message decoding
High
Network
Low
None
None
SummaryUnbounded recursion depth in Details
There is no recursion-depth counter anywhere in the decoder. For any schema with a self-referential message type (e.g. Reference protobuf implementations (Google's C++, Java, etc.) cap recursion at 100 specifically to prevent this. The Elixir decoder enforces no comparable bound, so the recursion continues until the process exhausts memory, blows the stack, or starves the scheduler doing GC over the deep structure. The fix threads a depth counter through PoC
ImpactUnauthenticated, network-reachable request-amplification denial of service against any service that decodes attacker-influenced protobuf bytes into a self-referential or cyclic message type. A single small request can consume seconds of CPU and hundreds of MB of memory on the victim; a few concurrent requests can take the node offline. Resources
Affected versions
0.10.0
0.11.0
0.12.0
0.13.0
0.14.0
0.14.1
0.15.0
0.16.0
0.8.0
0.9.0
Fixed in
0.16.1
References
Updated Jul 15, 2026 · Source: OSV.dev | ||
0.10.0
minor
1 CVE
CVE-2026-54451
GHSA-rv48-qqj5-crxg
Jul 15, 2026
Protobuf: Unbounded recursion depth in embedded-message decoding
High
Network
Low
None
None
SummaryUnbounded recursion depth in Details
There is no recursion-depth counter anywhere in the decoder. For any schema with a self-referential message type (e.g. Reference protobuf implementations (Google's C++, Java, etc.) cap recursion at 100 specifically to prevent this. The Elixir decoder enforces no comparable bound, so the recursion continues until the process exhausts memory, blows the stack, or starves the scheduler doing GC over the deep structure. The fix threads a depth counter through PoC
ImpactUnauthenticated, network-reachable request-amplification denial of service against any service that decodes attacker-influenced protobuf bytes into a self-referential or cyclic message type. A single small request can consume seconds of CPU and hundreds of MB of memory on the victim; a few concurrent requests can take the node offline. Resources
Affected versions
0.10.0
0.11.0
0.12.0
0.13.0
0.14.0
0.14.1
0.15.0
0.16.0
0.8.0
0.9.0
Fixed in
0.16.1
References
Updated Jul 15, 2026 · Source: OSV.dev | ||
0.9.0
minor
1 CVE
CVE-2026-54451
GHSA-rv48-qqj5-crxg
Jul 15, 2026
Protobuf: Unbounded recursion depth in embedded-message decoding
High
Network
Low
None
None
SummaryUnbounded recursion depth in Details
There is no recursion-depth counter anywhere in the decoder. For any schema with a self-referential message type (e.g. Reference protobuf implementations (Google's C++, Java, etc.) cap recursion at 100 specifically to prevent this. The Elixir decoder enforces no comparable bound, so the recursion continues until the process exhausts memory, blows the stack, or starves the scheduler doing GC over the deep structure. The fix threads a depth counter through PoC
ImpactUnauthenticated, network-reachable request-amplification denial of service against any service that decodes attacker-influenced protobuf bytes into a self-referential or cyclic message type. A single small request can consume seconds of CPU and hundreds of MB of memory on the victim; a few concurrent requests can take the node offline. Resources
Affected versions
0.10.0
0.11.0
0.12.0
0.13.0
0.14.0
0.14.1
0.15.0
0.16.0
0.8.0
0.9.0
Fixed in
0.16.1
References
Updated Jul 15, 2026 · Source: OSV.dev | ||
0.8.0
minor
1 CVE
CVE-2026-54451
GHSA-rv48-qqj5-crxg
Jul 15, 2026
Protobuf: Unbounded recursion depth in embedded-message decoding
High
Network
Low
None
None
SummaryUnbounded recursion depth in Details
There is no recursion-depth counter anywhere in the decoder. For any schema with a self-referential message type (e.g. Reference protobuf implementations (Google's C++, Java, etc.) cap recursion at 100 specifically to prevent this. The Elixir decoder enforces no comparable bound, so the recursion continues until the process exhausts memory, blows the stack, or starves the scheduler doing GC over the deep structure. The fix threads a depth counter through PoC
ImpactUnauthenticated, network-reachable request-amplification denial of service against any service that decodes attacker-influenced protobuf bytes into a self-referential or cyclic message type. A single small request can consume seconds of CPU and hundreds of MB of memory on the victim; a few concurrent requests can take the node offline. Resources
Affected versions
0.10.0
0.11.0
0.12.0
0.13.0
0.14.0
0.14.1
0.15.0
0.16.0
0.8.0
0.9.0
Fixed in
0.16.1
References
Updated Jul 15, 2026 · Source: OSV.dev | ||
0.8.0-beta.1
pre
| ||
0.8.0-beta
pre
| ||
0.7.1
patch
| ||
0.7.0
minor
| ||
0.6.3
patch
| ||
0.6.2
patch
| ||
0.6.1
minor
| ||
0.5.4
patch
| ||
0.5.3
patch
| ||
0.5.2
patch
| ||
0.5.0
minor
| ||
0.4.1
patch
| ||
0.4.0
minor
| ||
0.3.4
patch
| ||
0.3.3
patch
| ||
0.3.2
patch
| ||
0.3.1
patch
| ||
0.3.0
minor
| ||
0.2.0
minor
| ||
0.1.0
initial
|