CVE-2026-54451 elixir-protobuf CVE debrief

Who should care

Defenders responsible for Elixir-based systems, especially those using Elixir protobuf for decoding protobuf bytes, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-54451 is a high-severity vulnerability in Elixir protobuf that can lead to denial-of-service (DoS) conditions in systems decoding attacker-controlled protobuf bytes. Defenders should prioritize verification and remediation, especially in Elixir-based systems using Elixir protobuf.

• Potential for substantial CPU and memory consumption
• Possible pinning of BEAM scheduler
• Potential node exhaustion in Elixir-based systems

Technical summary

The Elixir protobuf library, a pure Elixir implementation of Google Protobuf, is vulnerable to a high-severity issue. When services decode attacker-controlled protobuf bytes with Protobuf.Decoder, and the schema contains a self-referential or cyclic message type, it can lead to a denial-of-service (DoS) condition. The issue arises from the lack of a nesting-depth limit in Protobuf.Decoder.value_for_field/3, which handles embedded?: true fields. This allows deeply nested embedded fields to retain non-tail recursive frames, leading to substantial CPU and memory consumption, potentially pinning a BEAM scheduler and exhausting the node.

Defensive priority

Defenders should prioritize verifying and upgrading to version 0.16.1 or later, especially in systems using Elixir protobuf for decoding protobuf bytes.

Recommended defensive actions

• Verify and upgrade to version 0.16.1 or later
• Review and limit nested protobuf message types
• Monitor for suspicious protobuf decoding activity
• Perform vulnerability scanning to identify exposed systems
• Implement additional logging and monitoring for protobuf decoding activity
• Review system configurations for potential weaknesses
• Conduct regular security audits to detect similar vulnerabilities

Evidence notes

The vulnerability is caused by the lack of a nesting-depth limit in Protobuf.Decoder.value_for_field/3, which handles embedded?: true fields. This allows deeply nested embedded fields to retain non-tail recursive frames, leading to substantial CPU and memory consumption.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.