Answer in brief
CVE-2026-104635 records a High severity (CVSS 8.2) vulnerability in Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages. The current sources do not mark it as known exploited. The current feed maps elixir-protobuf/elixir-protobuf/protobuf (generic), elixir-protobuf/elixir-protobuf/protobuf (generic), elixir-protobuf/protobuf (generic), elixir-protobuf/protobuf (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps elixir-protobuf/elixir-protobuf/protobuf (generic), elixir-protobuf/elixir-protobuf/protobuf (generic), elixir-protobuf/protobuf (generic), elixir-protobuf/protobuf (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| elixir-protobuf/elixir-protobuf/protobufgeneric | >=b0a1d4eaffaf50012fa71a8e931a47cf252d0370 <* | * |
| elixir-protobuf/elixir-protobuf/protobufgeneric | >=b0a1d4eaffaf50012fa71a8e931a47cf252d0370 <e9432ad1c4099511905353cebcececa3a1f7c3ff | e9432ad1c4099511905353cebcececa3a1f7c3ff |
| elixir-protobuf/protobufgeneric | >=0.8.0 <* | * |
| elixir-protobuf/protobufgeneric | >=0.8.0 <0.17.1 | 0.17.1 |
Published upstream
Oct 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 9, 2026
Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 into a schema that contains a self-referential or cyclic message type is affected. In lib/protobuf/json/decode.ex, the embedded-message clause of decode_singular/3 recurses into internal_from_json_data/3 once per nesting level without incrementing or checking the decoder's depth counter. The depth guard increase_depth_and_maybe_throw/1 covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct clauses, so the recursion_limit option has no effect on user-defined message types. Each nesting level allocates a stack frame and heap objects, and a sufficiently deep document exhausts the memory of the decoding process. Confidentiality and integrity are not affected. This issue affects protobuf: from 0.8.0 before 0.17.1.
Quoted source text, attributed separately from HOL analysis.