The vulnerability arises from an unbounded recursive descent when decoding protobuf messages that contain self-referential or cyclic embedded message types. During the decode/build_message/value_for_field call chain the library does not enforce a nesting-depth limit, allowing an attacker to send a relatively small payload that generates a deep recursion chain. The recursive frames are non-tail-recursive, consuming significant CPU cycles, heap memory, and BEAM scheduler slots, which can eventually exhaust the node and bring the service offline.

This issue affects the elixir‑protobuf:protobuf library from releases 0.8.0 up to and including 0.16.1. Any application that uses Protobuf.Decoder to interpret data that can be controlled by an adversary is susceptible.

The CVSS score of 8.2 indicates high severity, but the EPSS score of less than 1 % suggests a low likelihood of widespread exploitation at this time. The vulnerability is not yet listed in the CISA KEV catalog. An attacker can exploit it by sending a crafted protobuf that references cyclic embedded messages; the attack vector is typically network‑based where the service accepts external protocol buffers. Successful exploitation would lead to denial of service through CPU and memory exhaustion, potentially impacting availability of the entire node.