Bug 2548406 (CVE-2026-104635)

Summary: CVE-2026-104635 protobuf: protobuf: Denial of Service via deeply nested JSON input
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, amctagga, anthomas, aoconnor, aos-team-art-private, asdas, ataylor, bniver, dpaolell, dranck, dschmidt, eglynn, ehelms, ehugonne, flucifre, ggainey, gmeno, groman, ikhan, jdelft, jjoyce, jlanda, jpasqual, jpretori, jschluet, jupierce, juwatts, kshier, lbrazdil, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mdellweg, mgarciac, mhackett, mhulan, mminar, nmoumoul, osousa, pcreech, ppalepu, ppostler, prdhamdh, rbiba, rbobbitt, rchan, rhel-process-autobot, sghai, sidsharm, simaishi, smallamp, sostapov, sskracic, stcannon, suppawar, tmalecek, tpfromme, vereddy, vlaad, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in protobuf. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by submitting a deeply nested JSON document to an application configured to decode self-referential message types. Because the decoder fails to enforce recursion limits on these structures, processing the input exhausts system memory and crashes the application.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-09 08:41:51 UTC 
Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 into a schema that contains a self-referential or cyclic message type is affected.

In lib/protobuf/json/decode.ex, the embedded-message clause of decode_singular/3 recurses into internal_from_json_data/3 once per nesting level without incrementing or checking the decoder's depth counter. The depth guard increase_depth_and_maybe_throw/1 covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct clauses, so the recursion_limit option has no effect on user-defined message types. Each nesting level allocates a stack frame and heap objects, and a sufficiently deep document exhausts the memory of the decoding process. Confidentiality and integrity are not affected.

This issue affects protobuf: from 0.8.0 onward.