GHSA-rv48-qqj5-crxg Protobuf: Unbounded recursion depth in embedded-message decoding

• Hex protobuf: >= 0.8.0, < 0.16.1 → fixed in 0.16.1

Summary Unbounded recursion depth in `Protobuf.Decoder` (Hex package `protobuf`, versions `>= 0.8.0, >` (tag `0x0A` = field 1, wire type 2). Use an iolist with a running byte-size to keep generation O(depth). 3. POST the body (a few MB at `depth = 1_000_000`) as `application/x-protobuf` to any endpoint that calls `Tree.decode/1`. 4. The non-tail `decode(bin, type)` in `value_for_field/3` re-enters once per nesting level, accumulating a frame per level. The decode burns seconds of CPU and hundreds of MB on the victim node; a few concurrent requests exhaust it. Impact Unauthenticated, network-reachable request-amplification denial of service against any service that decodes attacker-influenced protobuf bytes into a self-referential or cyclic message type. A single small request can consume seconds of CPU and hundreds of MB of memory on the victim; a few concurrent requests can take the node offline. Resources • Introduction commit: https://github.com/elixir-protobuf/protobuf/commit/21ec7c5bec4fec74e10c1de0d5d1a2d8152ac5d4 • Patch commit: https://github.com/elixir-protobuf/protobuf/commit/b8efa97790eece3d2d0e8e7c31a45ed409fe5338