protobuf

0.17.0

0.17.0 0.16.1 0.16.0 0.15.0 0.14.1 0.14.0 0.13.0 0.12.0 0.11.0 0.10.0 0.9.0 0.8.0 0.8.0-beta.1 0.8.0-beta retired 0.7.1 0.7.0 0.6.3 0.6.2 0.6.1 0.5.4 0.5.3 0.5.2 0.5.0 0.4.1 0.4.0 0.3.4 0.3.3 0.3.2 0.3.1 0.3.0 0.2.0 0.1.0

A pure Elixir implementation of Google Protobuf.

HexDocs Report package

Current section

1 Advisory

Jump to

Readme 32 Versions 1 Dependency 113 Dependants 1 Advisory Files Activity

GHSA-rv48-qqj5-crxg CVE-2026-54451

Protobuf: Unbounded recursion depth in embedded-message decoding

July 15, 2026

CVSS

8.2 / 10.0 High

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Versions

>= 0.8.0 and < 0.16.1

References

https://github.com/elixir-protobuf/protobuf
https://github.com/elixir-protobuf/protobuf/commit/21ec7c5bec4fec74e10c1de0d5d1a2d8152ac5d4
https://github.com/elixir-protobuf/protobuf/commit/b8efa97790eece3d2d0e8e7c31a45ed409fe5338
https://github.com/elixir-protobuf/protobuf/security/advisories/GHSA-rv48-qqj5-crxg

Checksum

Dependency Config

mix.exs

rebar.config

Gleam

erlang.mk

Package Details

Downloads Last 30 days, all versions

this version

267 529

yesterday

3 381

last 7 days

114 405

all time

24 206 277

Last Updated

Jun 08, 2026

License

MIT

Build Tools

mix

Publisher

whatyouhide

Owners

ericmj
tony612
whatyouhide

Operator	Description	Example
name:	Match package name. Supports * wildcards and repo/package form	name:phx* or name:hexpm/phoenix
description:	Full-text search of package descriptions	description:auth
depends:	Packages depending on a given package. Supports repo:package form	depends:ecto or depends:hexpm:ecto
build_tool:	Filter by build tool	build_tool:mix
updated_after:	Packages updated after an ISO8601 datetime	updated_after:2025-01-01T00:00:00Z
extra:	Match custom metadata (key,value). Nested keys are separated by commas	extra:license,MIT

protobuf

Checksum

Dependency Config

Package Details

Links

Owners

Search filters