The vulnerability is caused by uncontrolled recursion in elixir‑protobuf's JSON decoder. When a request passes a deeply nested or cyclic self‑referential message to Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3, the decoder recurses into internal_from_json_data/3 for each nesting level without incrementing or checking a global depth counter for user‑defined message types. The guard increase_depth_and_maybe_throw/1 covers only Google.Protobuf.ListValue and Google.Protobuf.Struct, so the recursion_limit option has no effect on other types. As each recursion consumes a stack frame and heap objects, a sufficiently deep document exhausts memory and crashes the decoding process. This loss of service is the primary impact; there is no direct confidentiality or integrity compromise. The weaknesses are identified as CWE-674 and CWE-770.

Any Elixir application that incorporates the elixir‑protobuf protobuf library, version 0.8.0 up to and including 0.17.0, is affected. The vulnerability exists wherever Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 is invoked on data that may contain user‑sup or cyclic message types.

The CVSS score of 8.2 indicates a high severity issue. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation but a realistic threat for exposed endpoints. The likely attack vector is an unauthenticated remote attacker delivering a deeply nested JSON document to any service that decodes JSON using the affected functions, forcing the process to crash and causing a denial‑of‑service condition. The exploit requires only the ability to send JSON to the application; no special privileges or authentication are needed.