Uncontrolled Recursion in Nanopb - #VU162835
Published: November 9, 2026
Vulnerability identifier: #VU162835
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause denial of service by crashing an application that decodes messages with Nanopb.
The vulnerability exists due to unbounded recursion in Nanopb's message decoder when processing deeply nested data against cyclic message definitions using callbacks or PB_ENABLE_MALLOC. An unauthenticated remote attacker can submit a specially crafted message with excessive nesting to exhaust the application's stack.
Affected software
Nanopb
Remediation
Install security update from vendor's website.
Nanopb - update to 0.4.9.2