Hex/protobuf CVE-2026-54451: high 8.2, EPSS 0.52%
Protobuf: Unbounded recursion depth in embedded-message decoding
Action: Upgrade protobuf to 0.16.1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.8.0 | 0.16.1 | - |
Fixed versions
| 0.16.1 |
Sources
- osv: GHSA-rv48-qqj5-crxg
- nvd: CVE-2026-54451
- https://github.com/elixir-protobuf/protobuf/security/advisories/GHSA-rv48-qqj5-crxg
- https://github.com/elixir-protobuf/protobuf/commit/21ec7c5bec4fec74e10c1de0d5d1a2d8152ac5d4
- https://github.com/elixir-protobuf/protobuf/commit/b8efa97790eece3d2d0e8e7c31a45ed409fe5338
- https://github.com/elixir-protobuf/protobuf
CVE-2026-54451 · published · modified · JSON