Uncontrolled Recursion Affecting protobuf package, versions >=0.8.0 <0.17.0

protobuf is a pure Elixir implementation of Google Protobuf.

Affected versions of this package are vulnerable to Uncontrolled Recursion in embedded-message decoding through value_for_field/3 in lib/protobuf/decoder.ex. An attacker can crash a service by sending a protobuf payload that nests a self-referential or cyclic embedded message hundreds of thousands or millions of levels deep. The decoder recurses once per embedded level with no depth limit, exhausting memory and CPU and pinning the BEAM scheduler while it processes the request; a small number of such requests can take the node offline.

Notes

• The advisory applies only to schemas that can recurse through embedded messages, such as self-referential types or type cycles; flat message definitions are not affected by this failure mode.
• The decoder’s default nesting cap is 100, but callers can pass :max_nesting_depth through Protobuf.decode/3 to override it for a given decode path.

• GitHub Commit
• Maintainer's Advisory