CVE-2026-104635 Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages
- Published
- Updated
- Exploit status
- No public exploit known
Description
Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 into a schema that contains a self-referential or cyclic message type is affected.
In lib/protobuf/json/decode.ex, the embedded-message clause of decode_singular/3 recurses into internal_from_json_data/3 once per nesting level without incrementing or checking the decoder's depth counter. The depth guard increase_depth_and_maybe_throw/1 covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct clauses, so the recursion_limit option has no effect on user-defined message types. Each nesting level allocates a stack frame and heap objects, and a sufficiently deep document exhausts the memory of the decoding process. Confidentiality and integrity are not affected.
This issue affects protobuf: from 0.8.0 before 0.17.1.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elixir-protobuf protobuf | >= 0.8.0, < 0.17.1 | 0.17.1 |
| elixir-protobuf protobuf | >= b0a1d4eaffaf50012fa71a8e931a47cf252d0370, < e9432ad1c4099511905353cebcececa3a1f7c3ff | e9432ad1c4099511905353cebcececa3a1f7c3ff |
| redhat/istio-proxy(Red Hat:service_mesh:3) | All versions | No fix listed |
| redhat/protobuf(Red Hat:amq_clients:2023) | All versions | No fix listed |
| redhat/python-protobuf(Red Hat:ansible_automation_platform:2) | All versions | No fix listed |
| redhat/protobuf(Red Hat:ceph_storage:9) | All versions | No fix listed |
| redhat/protobuf(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/protobuf(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/protobuf(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/protobuf(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/openshift/ose-rhel-coreos-8(Red Hat:openshift:4) | All versions | No fix listed |
| redhat/openshift/ose-rhel-coreos-9(Red Hat:openshift:4) | All versions | No fix listed |
| redhat/openshift/ose-rhel-coreos-9(Red Hat:openshift:5) | All versions | No fix listed |
| redhat/protobuf(Red Hat:openstack:16.2) | All versions | No fix listed |
| redhat/python-protobuf(Red Hat:satellite:6) | All versions | No fix listed |
| redhat/satellite:el8/python-protobuf(Red Hat:satellite:6) | All versions | No fix listed |
| redhat/python-protobuf(Red Hat:rhui:4::el8) | All versions | No fix listed |
References
- GitHub Advisory related vendor-advisory
- EEF CNA record for CVE-2026-104635 related
- OSV record EEF-CVE-2026-104635 exploit related
- Introducing commit b0a1d4e in elixir-protobuf/protobuf related
- Fix commit e9432ad in elixir-protobuf/protobuf patch
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2548406 issue-tracking
- www.cve.org
- nvd.nist.gov