CVE-2026-54451

Katalog CVE

CVSS 8.2 · High EPSS 0,52%

Kerentanan Uncontrolled Recursion. Skor CVSS 4.0 8.2 (High) menurut github.com.

Deskripsi (NVD)

Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex, Protobuf.Decoder.value_for_field/3 handles an embedded?: true field by recursively entering the decode / build_message / handle_value / value_for_field call chain without enforcing a nesting-depth limit. Deeply nested embedded fields retain non-tail recursive frames, allowing a comparatively small request to consume substantial CPU and memory, pin a BEAM scheduler, and exhaust the node. This issue is fixed in version 0.16.1.

Rincian

Terbit di NVD

17 September 2026

Terakhir diubah

24 September 2026

Status NVD

Awaiting Analysis

CVSS 4.0

8.2 (High), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-674: Uncontrolled Recursion

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/elixir-protobuf/protobuf/commit/352d1769a0ef575a8d18c3f9620609efdb73e2bc
• https://github.com/elixir-protobuf/protobuf/commit/b8efa97790eece3d2d0e8e7c31a45ed409fe5338
• https://github.com/elixir-protobuf/protobuf/releases/tag/v0.16.1
• https://github.com/elixir-protobuf/protobuf/security/advisories/GHSA-rv48-qqj5-crxg