CVE-2026-104635: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-104635 is an uncontrolled recursion vulnerability in the JSON decoder (Protobuf.JSON.Decode) of the elixir-protobuf protobuf Hex package that allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. It affects versions >= 0.8.0 and <= 0.17.0 of the protobuf package for Elixir/Erlang; version 0.17.1 contains the fix. The vulnerability was published on October 9, 2026, and is classified as High severity with a CVSS v4.0 base score of 8.2 (GitHub Advisory, Red Hat CVE).

The root cause is an uncontrolled recursion flaw (CWE-674) combined with allocation without limits (CWE-770) in lib/protobuf/json/decode.ex. The decode_singular/3 function's embedded-message clause calls internal_from_json_data/3 recursively for each nesting level without incrementing or checking the decoder's depth counter (state.depth remains 0 throughout). The existing depth guard increase_depth_and_maybe_throw/1 is only applied to Google.Protobuf.ListValue and Google.Protobuf.Struct well-known types, meaning the recursion_limit option has no effect on user-defined message types. An attacker targeting any endpoint that calls Protobuf.JSON.decode/3, decode!/3, or from_decoded/3 on a schema with a self-referential or cyclic message type (e.g., message TreeNode { TreeNode child = 1; }) can trigger unbounded recursion — approximately 100 KB of JSON yields ~5,000 nesting levels, each allocating a fresh stack frame and heap objects (GitHub Advisory, OSV).

Successful exploitation causes a deterministic crash of the BEAM decoding process through stack and memory exhaustion, resulting in a denial of service. Because the BEAM max_heap_size process flag defaults to unlimited, a sufficiently deep document or a handful of concurrent requests can plausibly exhaust the memory of the entire node, disrupting co-located workloads beyond just the targeted request process. Confidentiality and integrity are not affected — the impact is limited to availability (GitHub Advisory).

A proof-of-concept is publicly available on OSV.dev demonstrating the exploit steps, though no active in-the-wild exploitation has been observed. The attack requires no authentication, no privileges, and no user interaction — a single crafted HTTP request to a vulnerable endpoint is sufficient. The NVD SSVC assessment classifies exploitation as "poc" and automatable as "no" (due to the precondition that the target schema must contain a self-referential or cyclic message type). The EPSS score is approximately 0.387%, and the vulnerability is not currently listed in the CISA KEV catalog (OSV, Red Hat CVE).

1. Reconnaissance: Identify application endpoints that accept JSON request bodies and decode them using Protobuf.JSON.decode/3, decode!/3, or from_decoded/3 into a protobuf schema containing a self-referential or cyclic message type (e.g., a TreeNode message with a child field of type TreeNode).
2. Craft the payload: Build a deeply nested JSON document targeting the self-referential field. For example, wrap {} inside {"child": ...} approximately 5,000 times to produce a ~100 KB payload:

depth = 5_000
json = Enum.reduce(1..depth, "{}", fn _level, inner ->
  "{\"child\":" <> inner <> "}"
end)

3. Send the request: Submit the crafted JSON body to the vulnerable endpoint via a standard HTTP POST request. No authentication headers or special privileges are required.
4. Trigger unbounded recursion: The decoder recurses once per nesting level through internal_from_json_data/3 -> decode_message/4 -> decode_regular_fields/3 -> decode_value/3 -> decode_singular/3 and back, with no depth check applied. Even if recursion_limit: 100 is explicitly set, it has no effect on user-defined message types.
5. Achieve denial of service: The decoding process exhausts stack frames and heap memory, crashing the BEAM process. Sending concurrent requests amplifies the impact, potentially exhausting node-wide memory and disrupting all co-located workloads (GitHub Advisory, OSV).

• Network: Unusually large JSON request bodies (>100 KB) sent to API endpoints that process protobuf-encoded data; repeated requests from the same source IP targeting JSON-accepting endpoints.
• Logs: Application logs showing BEAM process crashes or out-of-memory errors coinciding with JSON decode operations; error entries referencing Protobuf.JSON.Decode or internal_from_json_data; absence of {:recursion_limit_exceeded, N} errors despite deeply nested input (indicating the unguarded code path was hit).
• Process: Sudden termination of Elixir/Erlang BEAM worker processes; node-wide memory exhaustion events; supervisor restart storms following process crashes attributed to JSON decoding tasks.

Upgrade the protobuf Hex package to version 0.17.1 or later, which fixes the vulnerability by adding increase_depth_and_maybe_throw/1 calls in decode_message/4 and the Google.Protobuf.Any clause of internal_from_json_data/3, enforcing the recursion_limit for all message types (GitHub Fix Commit). As an interim workaround without a code change, operators should enforce request body size limits (e.g., reject bodies >50 KB) and validate or reject deeply nested JSON at the web server or middleware layer before it reaches the decoder. Avoiding exposure of endpoints that decode attacker-controlled JSON into self-referential protobuf schemas is also advisable until patching is complete (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by researcher @manus-pi (GitHub) and published by the Erlang Ecosystem Foundation (EEF) CNA. The advisory notes this is a bypass of a prior related fix (GHSA-rv48-qqj5-crxg / CVE-2026-54451) that addressed the same unbounded recursion issue in the binary decoder (Protobuf.Decoder) in version 0.16.1, but did not cover the JSON decoder path — highlighting the risk of incomplete security fixes in serialization libraries (GitHub Advisory).