---
id: CVE-2026-54451
title: Elixir protobuf is a pure Elixir implementation of Google Protobuf
summary: >-
  Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0
  until 0.16.1, services that decode attacker-controlled protobuf bytes with
  Protobuf.Decoder can be taken offline when the schema contains a
  self-referential o…
severity: high
cvss: 8.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-674
  - CWE-770
vendor: elixir-protobuf
product: protobuf
affected:
  - 'protobuf >= 0.8.0, < 0.16.1'
patched:
  - protobuf 0.16.1
published: '2026-09-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:16:28.120'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54451'
references:
  - url: >-
      https://github.com/elixir-protobuf/protobuf/commit/352d1769a0ef575a8d18c3f9620609efdb73e2bc
    label: security-advisories@github.com
  - url: >-
      https://github.com/elixir-protobuf/protobuf/commit/b8efa97790eece3d2d0e8e7c31a45ed409fe5338
    label: security-advisories@github.com
  - url: 'https://github.com/elixir-protobuf/protobuf/releases/tag/v0.16.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/elixir-protobuf/protobuf/security/advisories/GHSA-rv48-qqj5-crxg
    label: security-advisories@github.com
  - url: >-
      https://github.com/elixir-protobuf/protobuf/security/advisories/GHSA-rv48-qqj5-crxg
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://github.com/elixir-protobuf/protobuf/commit/21ec7c5bec4fec74e10c1de0d5d1a2d8152ac5d4
  - url: 'https://github.com/advisories/GHSA-rv48-qqj5-crxg'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54451.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-54451'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536605'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-54451'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54451'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - erlang
  - csaf
  - vex
  - red-hat
epss: 0.00524
epssPercentile: 0.41925
aliases:
  - GHSA-rv48-qqj5-crxg
ecosystem: erlang
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-21T21:03:29.889055Z'
cvssSource: cna
scores:
  cna: 8.2
  vendor: 7.5
ingestedAt: '2026-07-15T18:45:16.982Z'
---

## Overview

Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex, Protobuf.Decoder.value_for_field/3 handles an embedded?: true field by recursively entering the decode / build_message / handle_value / value_for_field call chain without enforcing a nesting-depth limit. Deeply nested embedded fields retain non-tail recursive frames, allowing a comparatively small request to consume substantial CPU and memory, pin a BEAM scheduler, and exhaust the node. This issue is fixed in version 0.16.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54451)

Affected packages:

- `protobuf >= 0.8.0, < 0.16.1`

Patched in:

- `protobuf 0.16.1`

Source: https://github.com/advisories/GHSA-rv48-qqj5-crxg

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54451.json)