CVE-2026-54451

[CVE catalog]

Severity

High · CVSS 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Sep 17, 2026, 6:19:25 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.52% · Oct 25, 2026

A flaw was found in Elixir protobuf, a pure Elixir implementation of Google Protobuf. An attacker can craft protobuf messages with a self-referential or cyclic message type. When these messages are decoded by the `Protobuf.Decoder` component, specifically the `value_for_field` function, an unbounded recursion occurs due to the lack of a nesting-depth limit. This excessive recursion consumes substantial CPU and memory resources, leading to a Denial of Service (DoS) by taking the affected service offline. protobuf: Elixir protobuf: Denial of Service via unbounded recursion in message decoding An IMPORTANT severity denial of service flaw exists in the Elixir protobuf library, a pure Elixir implementation of Google Protocol Buffers. When a service uses Protobuf.Decoder to decode attacker-controlled protobuf bytes and the schema contains a self-referential or cyclic message type, the value_for_field function recurses into embedded messages without enforcing a nesting-depth limit. Because deeply nested embedded fields retain non-tail recursive stack frames, a comparatively small crafted request can consume substantial CPU and memory, pin a BEAM scheduler, and exhaust the node, taking the decoding service offline. Exploitation requires no authentication, privileges, or user interaction; the attacker only needs to supply crafted protobuf input to a service that decodes it. Red Hat Product Security rated this flaw CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), while the upstream CVSS 4.0 score is 8.2. The difference reflects upstream's assessment that exploitation is subject to attack requirements, whereas Red Hat assesses low attack complexity for services that decode untrusted protobuf input. Within the Red Hat portfolio, OpenShift Container Platform is affected through the RHEL CoreOS components (openshift/ose-rhel-coreos-8 and openshift/ose-rhel-coreos-9) across OpenShift 4 and OpenShift 5 update streams; the fix is being pursued by the responsible product teams under delegated resolution. The Red Hat Hardened Images (hummingbird) components are not affected, as the affected Elixir protobuf decoder is not present in those images. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.