Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
20 vulnerabilities by elixir-grpc
CVE-2026-124279 (GCVE-0-2026-124279)
Vulnerability from nvd – Published: 2026-11-13 16:18 – Updated: 2026-11-13 19:32
VLAI
EPSS
VEX
Title
Streaming request body limit enforced only after an 8 MB read in elixir-grpc grpc_server
Summary
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests.
The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with max_body_size only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all.
This issue affects grpc_server: from 1.0.0 before 1.1.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:55 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-124279.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-124279 | related |
| https://github.com/elixir-grpc/grpc/commit/49e18c… | related |
| https://github.com/elixir-grpc/grpc/commit/b1e771… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc_server |
Affected:
1.0.0 , < 1.1.0
(semver)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc_server |
Affected:
49e18c3ec6bb9afe2f712caad3dbab5c56a68a00 , < b1e771d558941b1ed4b6de8b39f6a5375543db01
(git)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124279",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:55:00.516542Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T19:32:24.719Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "grpc_server",
"packageURL": "pkg:hex/grpc_server",
"product": "grpc_server",
"programFiles": [
"lib/grpc/server/adapters/cowboy/handler.ex",
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_server",
"programFiles": [
"grpc_server/lib/grpc/server/adapters/cowboy/handler.ex",
"grpc_server/lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "b1e771d558941b1ed4b6de8b39f6a5375543db01",
"status": "affected",
"version": "49e18c3ec6bb9afe2f712caad3dbab5c56a68a00",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe server must expose at least one client-streaming or bidirectional-streaming RPC method.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."
}
],
"value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Alfie Goh Li Heng"
},
{
"lang": "en",
"type": "finder",
"value": "Alfie Goh Li Heng"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-11-13T11:19:13.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests.\u003c/p\u003e\n\u003cp\u003eThe streaming read clause of \u003ccode\u003eGRPC.Server.Adapters.Cowboy.Handler.info/3\u003c/code\u003e (\u003ccode\u003egrpc_server/lib/grpc/server/adapters/cowboy/handler.ex\u003c/code\u003e) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with \u003ccode\u003emax_body_size\u003c/code\u003e only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc_server: from 1.0.0 before 1.1.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests.\n\nThe streaming read clause of `GRPC.Server.Adapters.Cowboy.Handler.info/3` (`grpc_server/lib/grpc/server/adapters/cowboy/handler.ex`) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with `max_body_size` only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests.\n\nThe streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with max_body_size only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated client that opens many streaming calls can make the server buffer more request data than its configured limit allows and crash the node, taking down every service on it.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated client that opens many streaming calls can make the server buffer more request data than its configured limit allows and crash the node, taking down every service on it."
}
],
"value": "An unauthenticated client that opens many streaming calls can make the server buffer more request data than its configured limit allows and crash the node, taking down every service on it."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T16:18:56.700Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Streaming request body limit enforced only after an 8 MB read in elixir-grpc grpc_server",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-736x-r87j-jhcm"
},
{
"name": "EEF CNA record for CVE-2026-124279",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-124279.html"
},
{
"name": "OSV record EEF-CVE-2026-124279",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-124279"
},
{
"name": "Introducing commit 49e18c3 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/49e18c3ec6bb9afe2f712caad3dbab5c56a68a00"
},
{
"name": "Fix commit b1e771d in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/b1e771d558941b1ed4b6de8b39f6a5375543db01"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Streaming request body limit enforced only after an 8 MB read in elixir-grpc grpc_server",
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Large reads\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003easync_read_body/2\u003c/code\u003e asks Cowboy for up to 8,000,000 bytes per read on the streaming path, whatever \u003ccode\u003emax_body_size\u003c/code\u003e is set to.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. The limit is checked after the read\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003etrack_body_bytes/2\u003c/code\u003e adds each returned chunk to a running total and refuses the stream with \u003ccode\u003eRESOURCE_EXHAUSTED\u003c/code\u003e only once the total exceeds \u003ccode\u003emax_body_size\u003c/code\u003e. By then the whole chunk is in memory.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. No check on the length prefix\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe 5-byte gRPC prefix can declare up to 4 GiB. The server does not compare it with any limit before buffering, so a prefix that declares an oversized message does not stop the read.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4. Result\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eEach client-streaming or bidirectional-streaming call can make the server hold several megabytes more than the configured limit, and the attacker can open many such calls at once. Before 1.0.6 the streaming path had no limit, and \u003ccode\u003eGRPC.Server.Adapters.Cowboy.reading_stream/1\u003c/code\u003e buffered the whole body.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Large reads**\n\n`async_read_body/2` asks Cowboy for up to 8,000,000 bytes per read on the streaming path, whatever `max_body_size` is set to.\n\n**2. The limit is checked after the read**\n\n`track_body_bytes/2` adds each returned chunk to a running total and refuses the stream with `RESOURCE_EXHAUSTED` only once the total exceeds `max_body_size`. By then the whole chunk is in memory.\n\n**3. No check on the length prefix**\n\nThe 5-byte gRPC prefix can declare up to 4 GiB. The server does not compare it with any limit before buffering, so a prefix that declares an oversized message does not stop the read.\n\n**4. Result**\n\nEach client-streaming or bidirectional-streaming call can make the server hold several megabytes more than the configured limit, and the attacker can open many such calls at once. Before 1.0.6 the streaming path had no limit, and `GRPC.Server.Adapters.Cowboy.reading_stream/1` buffered the whole body."
}
],
"value": "1. Large reads\n\nasync_read_body/2 asks Cowboy for up to 8,000,000 bytes per read on the streaming path, whatever max_body_size is set to.\n\n2. The limit is checked after the read\n\ntrack_body_bytes/2 adds each returned chunk to a running total and refuses the stream with RESOURCE_EXHAUSTED only once the total exceeds max_body_size. By then the whole chunk is in memory.\n\n3. No check on the length prefix\n\nThe 5-byte gRPC prefix can declare up to 4 GiB. The server does not compare it with any limit before buffering, so a prefix that declares an oversized message does not stop the read.\n\n4. Result\n\nEach client-streaming or bidirectional-streaming call can make the server hold several megabytes more than the configured limit, and the attacker can open many such calls at once. Before 1.0.6 the streaming path had no limit, and GRPC.Server.Adapters.Cowboy.reading_stream/1 buffered the whole body."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-124279",
"datePublished": "2026-11-13T16:18:56.700Z",
"dateReserved": "2026-11-13T11:18:43.141Z",
"dateUpdated": "2026-11-13T19:32:24.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121809 (GCVE-0-2026-121809)
Vulnerability from nvd – Published: 2026-11-13 16:18 – Updated: 2026-11-13 19:32
VLAI
EPSS
VEX
Title
CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server
Summary
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.
GRPC.Server.Adapters.Cowboy.read_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with END_STREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.
This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:55 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-121809.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-121809 | related |
| https://github.com/elixir-grpc/grpc/commit/0332fa… | related |
| https://github.com/elixir-grpc/grpc/commit/38955f… | patch |
| https://github.com/elixir-grpc/grpc/commit/6d8a09… | related |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc_server |
Affected:
1.0.0 , < 1.1.0
(semver)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc_server |
Affected:
0332faae5f5e132314794dbfdae5edecbccea292 , < 38955f1392cbf08eef231a347348445410455c85
(git)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
0.3.1 , < 1.0.0
(semver)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
6d8a09ad919e208fb600538ac8b19bd733a04310 , < 0332faae5f5e132314794dbfdae5edecbccea292
(git)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121809",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:55:12.226355Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T19:32:40.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "grpc_server",
"packageURL": "pkg:hex/grpc_server",
"product": "grpc_server",
"programFiles": [
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_server",
"programFiles": [
"grpc_server/lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "38955f1392cbf08eef231a347348445410455c85",
"status": "affected",
"version": "0332faae5f5e132314794dbfdae5edecbccea292",
"versionType": "git"
}
]
},
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.3.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "0332faae5f5e132314794dbfdae5edecbccea292",
"status": "affected",
"version": "6d8a09ad919e208fb600538ac8b19bd733a04310",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe server must expose at least one client-streaming or bidirectional-streaming RPC method.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."
}
],
"value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Adam Jordan"
},
{
"lang": "en",
"type": "finder",
"value": "Adam Jordan"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Marko Vejnovic"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-11-13T11:19:46.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eLoop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eGRPC.Server.Adapters.Cowboy.read_stream/1\u003c/code\u003e (\u003ccode\u003egrpc_server/lib/grpc/server/adapters/cowboy.ex\u003c/code\u003e, and the Cowboy adapter in \u003ccode\u003egrpc\u003c/code\u003e before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with \u003ccode\u003eEND_STREAM\u003c/code\u003e keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.\n\n`GRPC.Server.Adapters.Cowboy.read_stream/1` (`grpc_server/lib/grpc/server/adapters/cowboy.ex`, and the Cowboy adapter in `grpc` before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with `END_STREAM` keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0."
}
],
"value": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.\n\nGRPC.Server.Adapters.Cowboy.read_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with END_STREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated client can keep one scheduler busy per open connection with a 5-byte request, and enough connections deny service to every application on the node.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated client can keep one scheduler busy per open connection with a 5-byte request, and enough connections deny service to every application on the node."
}
],
"value": "An unauthenticated client can keep one scheduler busy per open connection with a 5-byte request, and enough connections deny service to every application on the node."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with Unreachable Exit Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T16:18:37.954Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-c2h9-f9cc-27xh"
},
{
"name": "EEF CNA record for CVE-2026-121809",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-121809.html"
},
{
"name": "OSV record EEF-CVE-2026-121809",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-121809"
},
{
"name": "Introducing commit 0332faa in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
},
{
"name": "Fix commit 38955f1 in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/38955f1392cbf08eef231a347348445410455c85"
},
{
"name": "Introducing commit 6d8a09a in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/6d8a09ad919e208fb600538ac8b19bd733a04310"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server",
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eStart a server that exposes a client-streaming RPC, for example \u003ccode\u003eRouteGuide.RecordRoute\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOpen an HTTP/2 connection and send \u003ccode\u003eHEADERS\u003c/code\u003e for that method with \u003ccode\u003econtent-type: application/grpc\u003c/code\u003e and no \u003ccode\u003egrpc-timeout\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend one \u003ccode\u003eDATA\u003c/code\u003e frame with \u003ccode\u003eEND_STREAM\u003c/code\u003e that holds only the 5-byte prefix \u003ccode\u003e00 00 00 00 64\u003c/code\u003e, which declares a 100-byte message.\u003c/li\u003e\n\u003cli\u003eKeep the connection open and observe that no response arrives and one BEAM scheduler stays at 100% CPU until the connection closes.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a server that exposes a client-streaming RPC, for example `RouteGuide.RecordRoute`.\n2. Open an HTTP/2 connection and send `HEADERS` for that method with `content-type: application/grpc` and no `grpc-timeout`.\n3. Send one `DATA` frame with `END_STREAM` that holds only the 5-byte prefix `00 00 00 00 64`, which declares a 100-byte message.\n4. Keep the connection open and observe that no response arrives and one BEAM scheduler stays at 100% CPU until the connection closes."
}
],
"value": "* Start a server that exposes a client-streaming RPC, for example RouteGuide.RecordRoute.\n* Open an HTTP/2 connection and send HEADERS for that method with content-type: application/grpc and no grpc-timeout.\n* Send one DATA frame with END_STREAM that holds only the 5-byte prefix 00 00 00 00 64, which declares a 100-byte message.\n* Keep the connection open and observe that no response arrives and one BEAM scheduler stays at 100% CPU until the connection closes."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. A partial message\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eA client sends a 5-byte gRPC length prefix that declares more bytes than follow it, and ends the request body with \u003ccode\u003eEND_STREAM\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. The reader asks for more\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eread_stream/1\u003c/code\u003e calls \u003ccode\u003eGRPC.Message.get_message/1\u003c/code\u003e, which returns \u003ccode\u003efalse\u003c/code\u003e because the declared message is incomplete. \u003ccode\u003eread_stream/1\u003c/code\u003e then sets \u003ccode\u003eneed_more\u003c/code\u003e and reads again through \u003ccode\u003eHandler.read_body/1\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Every read is empty\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eOnce the body has been read, the handler\u0027s \u003ccode\u003easync_read_body/2\u003c/code\u003e (and \u003ccode\u003ecowboy_req:read_body/2\u003c/code\u003e in older releases) returns an empty chunk at once. The buffer stays the same, the exit clause for an empty finished buffer never matches, and the loop repeats.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4. No timeout ends it\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eEach iteration is a message round trip between two local processes, not a socket wait, so no I/O timeout applies. Without a \u003ccode\u003egrpc-timeout\u003c/code\u003e header there is no deadline, and the adapter\u0027s idle timeout defaults to \u003ccode\u003e:infinity\u003c/code\u003e. One scheduler stays at full load until the client closes the connection.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. A partial message**\n\nA client sends a 5-byte gRPC length prefix that declares more bytes than follow it, and ends the request body with `END_STREAM`.\n\n**2. The reader asks for more**\n\n`read_stream/1` calls `GRPC.Message.get_message/1`, which returns `false` because the declared message is incomplete. `read_stream/1` then sets `need_more` and reads again through `Handler.read_body/1`.\n\n**3. Every read is empty**\n\nOnce the body has been read, the handler\u0027s `async_read_body/2` (and `cowboy_req:read_body/2` in older releases) returns an empty chunk at once. The buffer stays the same, the exit clause for an empty finished buffer never matches, and the loop repeats.\n\n**4. No timeout ends it**\n\nEach iteration is a message round trip between two local processes, not a socket wait, so no I/O timeout applies. Without a `grpc-timeout` header there is no deadline, and the adapter\u0027s idle timeout defaults to `:infinity`. One scheduler stays at full load until the client closes the connection."
}
],
"value": "1. A partial message\n\nA client sends a 5-byte gRPC length prefix that declares more bytes than follow it, and ends the request body with END_STREAM.\n\n2. The reader asks for more\n\nread_stream/1 calls GRPC.Message.get_message/1, which returns false because the declared message is incomplete. read_stream/1 then sets need_more and reads again through Handler.read_body/1.\n\n3. Every read is empty\n\nOnce the body has been read, the handler\u0027s async_read_body/2 (and cowboy_req:read_body/2 in older releases) returns an empty chunk at once. The buffer stays the same, the exit clause for an empty finished buffer never matches, and the loop repeats.\n\n4. No timeout ends it\n\nEach iteration is a message round trip between two local processes, not a socket wait, so no I/O timeout applies. Without a grpc-timeout header there is no deadline, and the adapter\u0027s idle timeout defaults to :infinity. One scheduler stays at full load until the client closes the connection."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-121809",
"datePublished": "2026-11-13T16:18:37.954Z",
"dateReserved": "2026-11-13T11:19:13.834Z",
"dateUpdated": "2026-11-13T19:32:40.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124278 (GCVE-0-2026-124278)
Vulnerability from nvd – Published: 2026-11-13 15:58 – Updated: 2026-11-13 15:58
VLAI
EPSS
VEX
Title
Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server
Summary
Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.
Only the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.
This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-124278.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-124278 | related |
| https://github.com/elixir-grpc/grpc/commit/0332fa… | related |
| https://github.com/elixir-grpc/grpc/commit/953ab9… | patch |
| https://github.com/elixir-grpc/grpc/commit/8aaf3d… | related |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc_server |
Affected:
1.0.0 , < 1.1.0
(semver)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc_server |
Affected:
0332faae5f5e132314794dbfdae5edecbccea292 , < 953ab980d8a127e895d3ab9505fc4b9337bb32f7
(git)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
0.8.0 , < 1.0.0
(semver)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048 , < 0332faae5f5e132314794dbfdae5edecbccea292
(git)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027"
],
"packageName": "grpc_server",
"packageURL": "pkg:hex/grpc_server",
"product": "grpc_server",
"programFiles": [
"lib/grpc/server.ex",
"lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server\u0027:do_handle_request/4"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:init/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_server",
"programFiles": [
"grpc_server/lib/grpc/server.ex",
"grpc_server/lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server\u0027:do_handle_request/4"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:init/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "953ab980d8a127e895d3ab9505fc4b9337bb32f7",
"status": "affected",
"version": "0332faae5f5e132314794dbfdae5edecbccea292",
"versionType": "git"
}
]
},
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server.ex",
"lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server\u0027:do_handle_request/4"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:init/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.8.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server.ex",
"lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server\u0027:do_handle_request/4"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:init/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "0332faae5f5e132314794dbfdae5edecbccea292",
"status": "affected",
"version": "8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eHTTP-to-gRPC transcoding must be enabled with \u003ccode\u003ehttp_transcode: true\u003c/code\u003e. Access to a resource must be decided from the URL path rather than from the decoded request, for example by an API gateway, proxy rule or WAF in front of the server.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "HTTP-to-gRPC transcoding must be enabled with `http_transcode: true`. Access to a resource must be decided from the URL path rather than from the decoded request, for example by an API gateway, proxy rule or WAF in front of the server."
}
],
"value": "HTTP-to-gRPC transcoding must be enabled with http_transcode: true. Access to a resource must be decided from the URL path rather than from the decoded request, for example by an API gateway, proxy rule or WAF in front of the server."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.8.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eurico Nicacio"
},
{
"lang": "en",
"type": "finder",
"value": "Eurico Nicacio"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-11-13T11:18:41.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.\u003c/p\u003e\n\u003cp\u003eOnly the transcoding clause of \u003ccode\u003eGRPC.Server.do_handle_request/4\u003c/code\u003e (\u003ccode\u003egrpc_server/lib/grpc/server.ex\u003c/code\u003e, and \u003ccode\u003elib/grpc/server.ex\u003c/code\u003e before the package split) applies the route\u0027s path bindings to the request message. The Cowboy handler picks that clause from the request \u003ccode\u003eContent-Type\u003c/code\u003e, not from the route. A request to a transcoded URL with \u003ccode\u003eapplication/grpc\u003c/code\u003e or \u003ccode\u003eapplication/grpc-web\u003c/code\u003e is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.\n\nOnly the transcoding clause of `GRPC.Server.do_handle_request/4` (`grpc_server/lib/grpc/server.ex`, and `lib/grpc/server.ex` before the package split) applies the route\u0027s path bindings to the request message. The Cowboy handler picks that clause from the request `Content-Type`, not from the route. A request to a transcoded URL with `application/grpc` or `application/grpc-web` is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.\n\nOnly the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route\u0027s path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-460",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant\u0027s data.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant\u0027s data."
}
],
"value": "An attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant\u0027s data."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "CWE-436 Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:58:08.134Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xc5v-89vq-hv5m"
},
{
"name": "EEF CNA record for CVE-2026-124278",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-124278.html"
},
{
"name": "OSV record EEF-CVE-2026-124278",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-124278"
},
{
"name": "Introducing commit 0332faa in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
},
{
"name": "Fix commit 953ab98 in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/953ab980d8a127e895d3ab9505fc4b9337bb32f7"
},
{
"name": "Introducing commit 8aaf3d3 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server",
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eStart a server with \u003ccode\u003ehttp_transcode: true\u003c/code\u003e and a transcoded route that binds a field from the path, for example \u003ccode\u003eGET /v1/messages/{name}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eBuild a gRPC frame whose message sets \u003ccode\u003ename\u003c/code\u003e to \u003ccode\u003evictim\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend it over HTTP/1.1 as \u003ccode\u003eGET /v1/messages/alice\u003c/code\u003e with \u003ccode\u003eContent-Type: application/grpc\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eObserve that the handler receives \u003ccode\u003ename\u003c/code\u003e set to \u003ccode\u003evictim\u003c/code\u003e, not \u003ccode\u003ealice\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a server with `http_transcode: true` and a transcoded route that binds a field from the path, for example `GET /v1/messages/{name}`.\n2. Build a gRPC frame whose message sets `name` to `victim`.\n3. Send it over HTTP/1.1 as `GET /v1/messages/alice` with `Content-Type: application/grpc`.\n4. Observe that the handler receives `name` set to `victim`, not `alice`."
}
],
"value": "* Start a server with http_transcode: true and a transcoded route that binds a field from the path, for example GET /v1/messages/{name}.\n* Build a gRPC frame whose message sets name to victim.\n* Send it over HTTP/1.1 as GET /v1/messages/alice with Content-Type: application/grpc.\n* Observe that the handler receives name set to victim, not alice."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. The header selects the clause\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe Cowboy handler derives the access mode from the request \u003ccode\u003eContent-Type\u003c/code\u003e. \u003ccode\u003eapplication/json\u003c/code\u003e selects \u003ccode\u003e:http_transcoding\u003c/code\u003e, \u003ccode\u003eapplication/grpc\u003c/code\u003e selects \u003ccode\u003e:grpc\u003c/code\u003e and \u003ccode\u003eapplication/grpc-web+proto\u003c/code\u003e selects \u003ccode\u003e:grpcweb\u003c/code\u003e. The router still matches the transcoded URL template and extracts its path bindings.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Bindings are applied in one clause only\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eGRPC.Server.do_handle_request/4\u003c/code\u003e reads the bindings with \u003ccode\u003eadapter.get_bindings/1\u003c/code\u003e and merges them through \u003ccode\u003eGRPC.Server.Transcode.map_request/5\u003c/code\u003e only in the \u003ccode\u003e:http_transcoding\u003c/code\u003e clause. The unary and request-streaming clauses decode the body alone with the selected codec. \u003ccode\u003eGRPC.Codec.Proto\u003c/code\u003e is in the default codecs of every server, so \u003ccode\u003eapplication/grpc\u003c/code\u003e is always accepted.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. The HTTP/1.1 guard never matches\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eresolve_access_mode/3\u003c/code\u003e has a clause that forces transcoding for HTTP/1.1 requests. It matches the version as the binary \u003ccode\u003e\"HTTP/1.1\"\u003c/code\u003e, while Cowboy stores the version as an atom, so the clause never applies and the request works over plain HTTP/1.1.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4. Result\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eA request to \u003ccode\u003e/v1/messages/alice\u003c/code\u003e with \u003ccode\u003eContent-Type: application/grpc\u003c/code\u003e and a message that sets \u003ccode\u003ename\u003c/code\u003e to \u003ccode\u003evictim\u003c/code\u003e reaches the handler with \u003ccode\u003ename\u003c/code\u003e set to \u003ccode\u003evictim\u003c/code\u003e. With an empty message the field is empty: the path binding is never consulted.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. The header selects the clause**\n\nThe Cowboy handler derives the access mode from the request `Content-Type`. `application/json` selects `:http_transcoding`, `application/grpc` selects `:grpc` and `application/grpc-web+proto` selects `:grpcweb`. The router still matches the transcoded URL template and extracts its path bindings.\n\n**2. Bindings are applied in one clause only**\n\n`GRPC.Server.do_handle_request/4` reads the bindings with `adapter.get_bindings/1` and merges them through `GRPC.Server.Transcode.map_request/5` only in the `:http_transcoding` clause. The unary and request-streaming clauses decode the body alone with the selected codec. `GRPC.Codec.Proto` is in the default codecs of every server, so `application/grpc` is always accepted.\n\n**3. The HTTP/1.1 guard never matches**\n\n`resolve_access_mode/3` has a clause that forces transcoding for HTTP/1.1 requests. It matches the version as the binary `\"HTTP/1.1\"`, while Cowboy stores the version as an atom, so the clause never applies and the request works over plain HTTP/1.1.\n\n**4. Result**\n\nA request to `/v1/messages/alice` with `Content-Type: application/grpc` and a message that sets `name` to `victim` reaches the handler with `name` set to `victim`. With an empty message the field is empty: the path binding is never consulted."
}
],
"value": "1. The header selects the clause\n\nThe Cowboy handler derives the access mode from the request Content-Type. application/json selects :http_transcoding, application/grpc selects :grpc and application/grpc-web+proto selects :grpcweb. The router still matches the transcoded URL template and extracts its path bindings.\n\n2. Bindings are applied in one clause only\n\nGRPC.Server.do_handle_request/4 reads the bindings with adapter.get_bindings/1 and merges them through GRPC.Server.Transcode.map_request/5 only in the :http_transcoding clause. The unary and request-streaming clauses decode the body alone with the selected codec. GRPC.Codec.Proto is in the default codecs of every server, so application/grpc is always accepted.\n\n3. The HTTP/1.1 guard never matches\n\nresolve_access_mode/3 has a clause that forces transcoding for HTTP/1.1 requests. It matches the version as the binary \"HTTP/1.1\", while Cowboy stores the version as an atom, so the clause never applies and the request works over plain HTTP/1.1.\n\n4. Result\n\nA request to /v1/messages/alice with Content-Type: application/grpc and a message that sets name to victim reaches the handler with name set to victim. With an empty message the field is empty: the path binding is never consulted."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-124278",
"datePublished": "2026-11-13T15:58:08.134Z",
"dateReserved": "2026-11-09T23:03:52.038Z",
"dateUpdated": "2026-11-13T15:58:08.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123635 (GCVE-0-2026-123635)
Vulnerability from nvd – Published: 2026-11-13 15:40 – Updated: 2026-11-13 15:40
VLAI
EPSS
VEX
Title
Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server
Summary
Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.
The stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.
This issue affects grpc_server: from 1.0.0 before 1.1.0.
Severity
CWE
- CWE-772 - Missing Release of Resource after Effective Lifetime
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-123635.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-123635 | related |
| https://github.com/elixir-grpc/grpc/commit/0332fa… | related |
| https://github.com/elixir-grpc/grpc/commit/61a719… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc_server |
Affected:
1.0.0 , < 1.1.0
(semver)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc_server |
Affected:
0332faae5f5e132314794dbfdae5edecbccea292 , < 61a71948e6e7b95efb27d48e7084c764503cc802
(git)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"grpc_stream_h"
],
"packageName": "grpc_server",
"packageURL": "pkg:hex/grpc_server",
"product": "grpc_server",
"programFiles": [
"src/grpc_stream_h.erl"
],
"programRoutines": [
{
"name": "grpc_stream_h:init/3"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"grpc_stream_h"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_server",
"programFiles": [
"grpc_server/src/grpc_stream_h.erl"
],
"programRoutines": [
{
"name": "grpc_stream_h:init/3"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "61a71948e6e7b95efb27d48e7084c764503cc802",
"status": "affected",
"version": "0332faae5f5e132314794dbfdae5edecbccea292",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCalls from more than one caller must share one HTTP/2 connection to the server, for example through a proxy or a shared client channel.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Calls from more than one caller must share one HTTP/2 connection to the server, for example through a proxy or a shared client channel."
}
],
"value": "Calls from more than one caller must share one HTTP/2 connection to the server, for example through a proxy or a shared client channel."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Aaron Lovi"
},
{
"lang": "en",
"type": "finder",
"value": "Aaron Lovi"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-11-12T20:33:14.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.\u003c/p\u003e\n\u003cp\u003eThe stream handler \u003ccode\u003egrpc_stream_h\u003c/code\u003e (\u003ccode\u003egrpc_server/src/grpc_stream_h.erl\u003c/code\u003e) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds \u003ccode\u003emax_body_size\u003c/code\u003e or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc_server: from 1.0.0 before 1.1.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.\n\nThe stream handler `grpc_stream_h` (`grpc_server/src/grpc_stream_h.erl`) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds `max_body_size` or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."
}
],
"value": "Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.\n\nThe stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-131",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally."
}
],
"value": "A client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-772",
"description": "CWE-772 Missing Release of Resource after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:40:16.288Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-7x9q-vvph-rjcr"
},
{
"name": "EEF CNA record for CVE-2026-123635",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-123635.html"
},
{
"name": "OSV record EEF-CVE-2026-123635",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-123635"
},
{
"name": "Introducing commit 0332faa in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
},
{
"name": "Fix commit 61a7194 in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/61a71948e6e7b95efb27d48e7084c764503cc802"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePut a Cowboy stream handler in front of \u003ccode\u003egrpc_stream_h\u003c/code\u003e with the adapter option \u003ccode\u003estream_handlers: [MyHandler, :grpc_stream_h]\u003c/code\u003e. In \u003ccode\u003einit/3\u003c/code\u003e, the handler calls \u003ccode\u003e:cowboy_stream.init/3\u003c/code\u003e and adds a \u003ccode\u003e{:flow, size}\u003c/code\u003e command when the request has a body, where \u003ccode\u003esize\u003c/code\u003e is Cowboy\u0027s \u003ccode\u003emax_frame_size_received\u003c/code\u003e (16384 by default). It passes all other callbacks to \u003ccode\u003e:cowboy_stream\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Put a Cowboy stream handler in front of `grpc_stream_h` with the adapter option `stream_handlers: [MyHandler, :grpc_stream_h]`. In `init/3`, the handler calls `:cowboy_stream.init/3` and adds a `{:flow, size}` command when the request has a body, where `size` is Cowboy\u0027s `max_frame_size_received` (16384 by default). It passes all other callbacks to `:cowboy_stream`."
}
],
"value": "Put a Cowboy stream handler in front of grpc_stream_h with the adapter option stream_handlers: [MyHandler, :grpc_stream_h]. In init/3, the handler calls :cowboy_stream.init/3 and adds a {:flow, size} command when the request has a body, where size is Cowboy\u0027s max_frame_size_received (16384 by default). It passes all other callbacks to :cowboy_stream."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eStart a gRPC server with a small \u003ccode\u003emax_body_size\u003c/code\u003e, for example 1000 bytes.\u003c/li\u003e\n\u003cli\u003eOpen one HTTP/2 connection with a client that tracks the connection window.\u003c/li\u003e\n\u003cli\u003eSend a unary call with a body above the limit and wait for the \u003ccode\u003eRESOURCE_EXHAUSTED\u003c/code\u003e reply.\u003c/li\u003e\n\u003cli\u003eSend more DATA frames on the refused stream, up to what the stream and connection windows allow.\u003c/li\u003e\n\u003cli\u003eRepeat steps 3 and 4 on new streams until the connection window is 0.\u003c/li\u003e\n\u003cli\u003eSend a small valid unary call on the same connection. Observe that its body cannot be sent and that the call ends at its deadline.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a gRPC server with a small `max_body_size`, for example 1000 bytes.\n2. Open one HTTP/2 connection with a client that tracks the connection window.\n3. Send a unary call with a body above the limit and wait for the `RESOURCE_EXHAUSTED` reply.\n4. Send more DATA frames on the refused stream, up to what the stream and connection windows allow.\n5. Repeat steps 3 and 4 on new streams until the connection window is 0.\n6. Send a small valid unary call on the same connection. Observe that its body cannot be sent and that the call ends at its deadline."
}
],
"value": "* Start a gRPC server with a small max_body_size, for example 1000 bytes.\n* Open one HTTP/2 connection with a client that tracks the connection window.\n* Send a unary call with a body above the limit and wait for the RESOURCE_EXHAUSTED reply.\n* Send more DATA frames on the refused stream, up to what the stream and connection windows allow.\n* Repeat steps 3 and 4 on new streams until the connection window is 0.\n* Send a small valid unary call on the same connection. Observe that its body cannot be sent and that the call ends at its deadline."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Flow is requested only for data that arrived\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eCowboy increases the HTTP/2 connection window only when a stream handler returns a \u003ccode\u003e{flow, N}\u003c/code\u003e command. \u003ccode\u003egrpc_stream_h\u003c/code\u003e returns that command only for request data it has received.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. A refused call leaves data uncredited\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eWhen the server refuses a call, the stream stops. The client can still have DATA frames in flight for it. Cowboy drops those frames without running the handler, so no flow is requested for their bytes and no connection-level \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e is sent.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. The window empties\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eEach refused call with DATA in flight reduces the connection window for good. With the default 65,535-byte window, the window was empty after two refused calls in a test against v1.0.6. An empty window stops all request data, so no handler requests flow again and the window stays empty.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4. Result\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eEvery later call on the connection that has a request body waits until its deadline. A new connection works normally.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Flow is requested only for data that arrived**\n\nCowboy increases the HTTP/2 connection window only when a stream handler returns a `{flow, N}` command. `grpc_stream_h` returns that command only for request data it has received.\n\n**2. A refused call leaves data uncredited**\n\nWhen the server refuses a call, the stream stops. The client can still have DATA frames in flight for it. Cowboy drops those frames without running the handler, so no flow is requested for their bytes and no connection-level `WINDOW_UPDATE` is sent.\n\n**3. The window empties**\n\nEach refused call with DATA in flight reduces the connection window for good. With the default 65,535-byte window, the window was empty after two refused calls in a test against v1.0.6. An empty window stops all request data, so no handler requests flow again and the window stays empty.\n\n**4. Result**\n\nEvery later call on the connection that has a request body waits until its deadline. A new connection works normally."
}
],
"value": "1. Flow is requested only for data that arrived\n\nCowboy increases the HTTP/2 connection window only when a stream handler returns a {flow, N} command. grpc_stream_h returns that command only for request data it has received.\n\n2. A refused call leaves data uncredited\n\nWhen the server refuses a call, the stream stops. The client can still have DATA frames in flight for it. Cowboy drops those frames without running the handler, so no flow is requested for their bytes and no connection-level WINDOW_UPDATE is sent.\n\n3. The window empties\n\nEach refused call with DATA in flight reduces the connection window for good. With the default 65,535-byte window, the window was empty after two refused calls in a test against v1.0.6. An empty window stops all request data, so no handler requests flow again and the window stays empty.\n\n4. Result\n\nEvery later call on the connection that has a request body waits until its deadline. A new connection works normally."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-123635",
"datePublished": "2026-11-13T15:40:16.288Z",
"dateReserved": "2026-11-09T22:27:54.995Z",
"dateUpdated": "2026-11-13T15:40:16.288Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121808 (GCVE-0-2026-121808)
Vulnerability from nvd – Published: 2026-11-13 15:48 – Updated: 2026-11-13 15:48
VLAI
EPSS
VEX
Title
Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codec
Summary
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.
GRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body.
This issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0.
Severity
CWE
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Assigner
References
6 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc |
Affected:
0.4.0 , < 1.0.0
(semver)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
25bcc569fe2cc4478531a6c546c923205fc751c9 , < 0332faae5f5e132314794dbfdae5edecbccea292
(git)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc_core |
Affected:
1.0.0 , < 1.1.0
(semver)
cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc_core |
Affected:
0332faae5f5e132314794dbfdae5edecbccea292 , < d6bc56ac75dfb6c02db2099909210a37c9be8db6
(git)
cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Codec.Erlpack\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.4.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Codec.Erlpack\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "0332faae5f5e132314794dbfdae5edecbccea292",
"status": "affected",
"version": "25bcc569fe2cc4478531a6c546c923205fc751c9",
"versionType": "git"
}
]
},
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Codec.Erlpack\u0027"
],
"packageName": "grpc_core",
"packageURL": "pkg:hex/grpc_core",
"product": "grpc_core",
"programFiles": [
"lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Codec.Erlpack\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_core",
"programFiles": [
"grpc_core/lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "d6bc56ac75dfb6c02db2099909210a37c9be8db6",
"status": "affected",
"version": "0332faae5f5e132314794dbfdae5edecbccea292",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003ccode\u003eGRPC.Codec.Erlpack\u003c/code\u003e must be explicitly registered as a codec on the gRPC server.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "`GRPC.Codec.Erlpack` must be explicitly registered as a codec on the gRPC server."
}
],
"value": "GRPC.Codec.Erlpack must be explicitly registered as a codec on the gRPC server."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jace"
},
{
"lang": "en",
"type": "finder",
"value": "zx"
},
{
"lang": "en",
"type": "reporter",
"value": "zx"
},
{
"lang": "en",
"type": "finder",
"value": "Jiacheng Zhong"
},
{
"lang": "en",
"type": "finder",
"value": "Zhun Wang"
},
{
"lang": "en",
"type": "finder",
"value": "Junmin Zhu"
},
{
"lang": "en",
"type": "finder",
"value": "Hongwei Li"
},
{
"lang": "en",
"type": "finder",
"value": "Han Dai"
},
{
"lang": "en",
"type": "finder",
"value": "Suyue Guo"
},
{
"lang": "en",
"type": "finder",
"value": "Songyang Peng"
},
{
"lang": "en",
"type": "finder",
"value": "Ziyue Pan"
},
{
"lang": "en",
"type": "reporter",
"value": "Hongwei Li"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "coordinator",
"value": "Peter Ullrich"
}
],
"dateAssigned": "2026-11-12T20:11:46.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eGRPC.Codec.Erlpack.decode/2\u003c/code\u003e (\u003ccode\u003egrpc_core/lib/grpc/codec/erlpack.ex\u003c/code\u003e, and \u003ccode\u003elib/grpc/codec/erlpack.ex\u003c/code\u003e before the package split) passes the message body to \u003ccode\u003e:erlang.binary_to_term/2\u003c/code\u003e. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server\u0027s \u003ccode\u003emax_body_size\u003c/code\u003e limit counts the compressed bytes of the request. A request with \u003ccode\u003eContent-Type: application/grpc+erlpack\u003c/code\u003e can therefore make the server allocate a term much larger than the request body.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.\n\n`GRPC.Codec.Erlpack.decode/2` (`grpc_core/lib/grpc/codec/erlpack.ex`, and `lib/grpc/codec/erlpack.ex` before the package split) passes the message body to `:erlang.binary_to_term/2`. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server\u0027s `max_body_size` limit counts the compressed bytes of the request. A request with `Content-Type: application/grpc+erlpack` can therefore make the server allocate a term much larger than the request body.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0."
}
],
"value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.\n\nGRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server\u0027s max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated client can make a server that registers the Erlpack codec allocate memory far beyond the size of the request with one request. Memory exhaustion affects every service on that node.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated client can make a server that registers the Erlpack codec allocate memory far beyond the size of the request with one request. Memory exhaustion affects every service on that node."
}
],
"value": "An unauthenticated client can make a server that registers the Erlpack codec allocate memory far beyond the size of the request with one request. Memory exhaustion affects every service on that node."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:48:49.871Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codec",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xxp9-7hp4-rqwp"
},
{
"name": "EEF CNA record for CVE-2026-121808",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-121808.html"
},
{
"name": "OSV record EEF-CVE-2026-121808",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-121808"
},
{
"name": "Introducing commit 25bcc56 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/25bcc569fe2cc4478531a6c546c923205fc751c9"
},
{
"name": "Fix commit 0332faa in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
},
{
"name": "Fix commit d6bc56a in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/d6bc56ac75dfb6c02db2099909210a37c9be8db6"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codec",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRemove \u003ccode\u003eGRPC.Codec.Erlpack\u003c/code\u003e from the server\u0027s \u003ccode\u003ecodecs\u003c/code\u003e list if the codec is not needed.\u003c/p\u003e\n\u003cp\u003eIf the codec is needed, register a wrapper codec in its place. The wrapper implements the \u003ccode\u003eGRPC.Codec\u003c/code\u003e behaviour, returns \u003ccode\u003e\"erlpack\"\u003c/code\u003e from \u003ccode\u003ename/0\u003c/code\u003e, raises in \u003ccode\u003edecode/2\u003c/code\u003e when the body starts with the bytes \u003ccode\u003e131, 80\u003c/code\u003e (the compressed term tag), and delegates all other calls to \u003ccode\u003eGRPC.Codec.Erlpack\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Remove `GRPC.Codec.Erlpack` from the server\u0027s `codecs` list if the codec is not needed.\n\nIf the codec is needed, register a wrapper codec in its place. The wrapper implements the `GRPC.Codec` behaviour, returns `\"erlpack\"` from `name/0`, raises in `decode/2` when the body starts with the bytes `131, 80` (the compressed term tag), and delegates all other calls to `GRPC.Codec.Erlpack`."
}
],
"value": "Remove GRPC.Codec.Erlpack from the server\u0027s codecs list if the codec is not needed.\n\nIf the codec is needed, register a wrapper codec in its place. The wrapper implements the GRPC.Codec behaviour, returns \"erlpack\" from name/0, raises in decode/2 when the body starts with the bytes 131, 80 (the compressed term tag), and delegates all other calls to GRPC.Codec.Erlpack."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eStart a gRPC server that registers \u003ccode\u003eGRPC.Codec.Erlpack\u003c/code\u003e in its \u003ccode\u003ecodecs\u003c/code\u003e list.\u003c/li\u003e\n\u003cli\u003eBuild the payload with \u003ccode\u003e:erlang.term_to_binary(:binary.copy(\u0026lt;\u0026lt;0\u0026gt;\u0026gt;, 268_435_456), [:compressed])\u003c/code\u003e. The result is 260,932 bytes.\u003c/li\u003e\n\u003cli\u003eSend the payload as one uncompressed gRPC message (compressed flag 0) to any method of the server, with \u003ccode\u003eContent-Type: application/grpc+erlpack\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eObserve that the server allocates the 268,435,456-byte binary and passes it to the application callback.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a gRPC server that registers `GRPC.Codec.Erlpack` in its `codecs` list.\n2. Build the payload with `:erlang.term_to_binary(:binary.copy(\u003c\u003c0\u003e\u003e, 268_435_456), [:compressed])`. The result is 260,932 bytes.\n3. Send the payload as one uncompressed gRPC message (compressed flag 0) to any method of the server, with `Content-Type: application/grpc+erlpack`.\n4. Observe that the server allocates the 268,435,456-byte binary and passes it to the application callback."
}
],
"value": "* Start a gRPC server that registers GRPC.Codec.Erlpack in its codecs list.\n* Build the payload with :erlang.term_to_binary(:binary.copy(\u003c\u003c0\u003e\u003e, 268_435_456), [:compressed]). The result is 260,932 bytes.\n* Send the payload as one uncompressed gRPC message (compressed flag 0) to any method of the server, with Content-Type: application/grpc+erlpack.\n* Observe that the server allocates the 268,435,456-byte binary and passes it to the application callback."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Codec selection\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe server selects the codec from the request \u003ccode\u003eContent-Type\u003c/code\u003e. \u003ccode\u003eapplication/grpc+erlpack\u003c/code\u003e selects \u003ccode\u003eGRPC.Codec.Erlpack\u003c/code\u003e when the server registers it. No authentication step comes before this.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Size limit on compressed bytes only\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe server limits the request body with \u003ccode\u003emax_body_size\u003c/code\u003e, which counts the bytes received. With the gRPC compressed flag set to 0, the transport decompression limit does not apply, and the message reaches the codec unchanged.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Expansion inside \u003ccode\u003ebinary_to_term/2\u003c/code\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eGRPC.Codec.Erlpack.decode/2\u003c/code\u003e calls \u003ccode\u003e:erlang.binary_to_term(binary, [:safe])\u003c/code\u003e. The Erlang external term format has a compressed form (version byte 131, tag 80, a 32-bit uncompressed size, then a zlib stream). \u003ccode\u003ebinary_to_term/2\u003c/code\u003e inflates it in full, and the \u003ccode\u003e:safe\u003c/code\u003e option does not limit the size. \u003ccode\u003eensure_safe_term!/1\u003c/code\u003e runs after the call returns and accepts a large binary.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4. Result\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eIn a test against grpc_server 1.0.6, a 260,932-byte request body decoded to a 268,435,456-byte binary, which the server passed to the application callback.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Codec selection**\n\nThe server selects the codec from the request `Content-Type`. `application/grpc+erlpack` selects `GRPC.Codec.Erlpack` when the server registers it. No authentication step comes before this.\n\n**2. Size limit on compressed bytes only**\n\nThe server limits the request body with `max_body_size`, which counts the bytes received. With the gRPC compressed flag set to 0, the transport decompression limit does not apply, and the message reaches the codec unchanged.\n\n**3. Expansion inside `binary_to_term/2`**\n\n`GRPC.Codec.Erlpack.decode/2` calls `:erlang.binary_to_term(binary, [:safe])`. The Erlang external term format has a compressed form (version byte 131, tag 80, a 32-bit uncompressed size, then a zlib stream). `binary_to_term/2` inflates it in full, and the `:safe` option does not limit the size. `ensure_safe_term!/1` runs after the call returns and accepts a large binary.\n\n**4. Result**\n\nIn a test against grpc_server 1.0.6, a 260,932-byte request body decoded to a 268,435,456-byte binary, which the server passed to the application callback."
}
],
"value": "1. Codec selection\n\nThe server selects the codec from the request Content-Type. application/grpc+erlpack selects GRPC.Codec.Erlpack when the server registers it. No authentication step comes before this.\n\n2. Size limit on compressed bytes only\n\nThe server limits the request body with max_body_size, which counts the bytes received. With the gRPC compressed flag set to 0, the transport decompression limit does not apply, and the message reaches the codec unchanged.\n\n3. Expansion inside binary_to_term/2\n\nGRPC.Codec.Erlpack.decode/2 calls :erlang.binary_to_term(binary, [:safe]). The Erlang external term format has a compressed form (version byte 131, tag 80, a 32-bit uncompressed size, then a zlib stream). binary_to_term/2 inflates it in full, and the :safe option does not limit the size. ensure_safe_term!/1 runs after the call returns and accepts a large binary.\n\n4. Result\n\nIn a test against grpc_server 1.0.6, a 260,932-byte request body decoded to a 268,435,456-byte binary, which the server passed to the application callback."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-121808",
"datePublished": "2026-11-13T15:48:49.871Z",
"dateReserved": "2026-11-09T22:35:50.462Z",
"dateUpdated": "2026-11-13T15:48:49.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71397 (GCVE-0-2026-71397)
Vulnerability from nvd – Published: 2026-11-06 21:02 – Updated: 2026-11-10 14:17
VLAI
EPSS
VEX
Title
Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server
Summary
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body.
The streaming read clause of 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) never checks the configured max_body_size. Only the unary read path enforces that cap. 'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex) appends every received chunk to its buffer until a complete length-prefixed message arrives. A client can declare a very large message and send it across many small HTTP/2 DATA frames, and the server buffers all of it.
This issue affects grpc_server: from 1.0.0 before 1.0.6.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:16 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-71397.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-71397 | related |
| https://github.com/elixir-grpc/grpc/commit/49e18c… | related |
| https://github.com/elixir-grpc/grpc/commit/0b663c… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc_server |
Affected:
1.0.0 , < 1.0.6
(semver)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc_server |
Affected:
49e18c3ec6bb9afe2f712caad3dbab5c56a68a00 , < 0b663ca53dbf0f36f7f67ff1d0026f4482a18915
(git)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71397",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:16:42.568773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:17:05.630Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-vx6q-cr5q-945g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "grpc_server",
"packageURL": "pkg:hex/grpc_server",
"product": "grpc_server",
"programFiles": [
"lib/grpc/server/adapters/cowboy/handler.ex",
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.6",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_server",
"programFiles": [
"grpc_server/lib/grpc/server/adapters/cowboy/handler.ex",
"grpc_server/lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "0b663ca53dbf0f36f7f67ff1d0026f4482a18915",
"status": "affected",
"version": "49e18c3ec6bb9afe2f712caad3dbab5c56a68a00",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe server must expose at least one client-streaming or bidirectional-streaming RPC method.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."
}
],
"value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.6",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arpit Jain"
},
{
"lang": "en",
"type": "reporter",
"value": "Arpit Jain"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Arpit Jain"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body.\u003c/p\u003e\n\u003cp\u003eThe streaming read clause of \u003ccode\u003e\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3\u003c/code\u003e (\u003ccode\u003egrpc_server/lib/grpc/server/adapters/cowboy/handler.ex\u003c/code\u003e) never checks the configured \u003ccode\u003emax_body_size\u003c/code\u003e. Only the unary read path enforces that cap. \u003ccode\u003e\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1\u003c/code\u003e (\u003ccode\u003egrpc_server/lib/grpc/server/adapters/cowboy.ex\u003c/code\u003e) appends every received chunk to its buffer until a complete length-prefixed message arrives. A client can declare a very large message and send it across many small HTTP/2 DATA frames, and the server buffers all of it.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc_server: from 1.0.0 before 1.0.6.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body.\n\nThe streaming read clause of `\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3` (`grpc_server/lib/grpc/server/adapters/cowboy/handler.ex`) never checks the configured `max_body_size`. Only the unary read path enforces that cap. `\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1` (`grpc_server/lib/grpc/server/adapters/cowboy.ex`) appends every received chunk to its buffer until a complete length-prefixed message arrives. A client can declare a very large message and send it across many small HTTP/2 DATA frames, and the server buffers all of it.\n\nThis issue affects grpc_server: from 1.0.0 before 1.0.6."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body.\n\nThe streaming read clause of \u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) never checks the configured max_body_size. Only the unary read path enforces that cap. \u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex) appends every received chunk to its buffer until a complete length-prefixed message arrives. A client can declare a very large message and send it across many small HTTP/2 DATA frames, and the server buffers all of it.\n\nThis issue affects grpc_server: from 1.0.0 before 1.0.6."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated client can crash a \u003ccode\u003egrpc_server\u003c/code\u003e node through one streaming RPC connection. This takes down every service on that node.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated client can crash a `grpc_server` node through one streaming RPC connection. This takes down every service on that node."
}
],
"value": "An unauthenticated client can crash a grpc_server node through one streaming RPC connection. This takes down every service on that node."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T21:02:03.676Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-vx6q-cr5q-945g"
},
{
"name": "EEF CNA record for CVE-2026-71397",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-71397.html"
},
{
"name": "OSV record EEF-CVE-2026-71397",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-71397"
},
{
"name": "Introducing commit 49e18c3 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/49e18c3ec6bb9afe2f712caad3dbab5c56a68a00"
},
{
"name": "Fix commit 0b663ca in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/0b663ca53dbf0f36f7f67ff1d0026f4482a18915"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server",
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eStart a \u003ccode\u003egrpc_server\u003c/code\u003e endpoint that exposes a client-streaming or bidirectional-streaming RPC method.\u003c/li\u003e\n\u003cli\u003eOpen an HTTP/2 connection and send a request to that method.\u003c/li\u003e\n\u003cli\u003eSend the request body across many small HTTP/2 DATA frames without \u003ccode\u003eEND_STREAM\u003c/code\u003e, well past the configured \u003ccode\u003emax_body_size\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eObserve that the server buffers all of it and server memory grows. The equivalent unary call is rejected with \u003ccode\u003eRESOURCE_EXHAUSTED\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a `grpc_server` endpoint that exposes a client-streaming or bidirectional-streaming RPC method.\n2. Open an HTTP/2 connection and send a request to that method.\n3. Send the request body across many small HTTP/2 DATA frames without `END_STREAM`, well past the configured `max_body_size`.\n4. Observe that the server buffers all of it and server memory grows. The equivalent unary call is rejected with `RESOURCE_EXHAUSTED`."
}
],
"value": "* Start a grpc_server endpoint that exposes a client-streaming or bidirectional-streaming RPC method.\n* Open an HTTP/2 connection and send a request to that method.\n* Send the request body across many small HTTP/2 DATA frames without END_STREAM, well past the configured max_body_size.\n* Observe that the server buffers all of it and server memory grows. The equivalent unary call is rejected with RESOURCE_EXHAUSTED."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. The cap applies to unary reads only\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe commit that added \u003ccode\u003emax_body_size\u003c/code\u003e checks it in \u003ccode\u003eread_full_body/4\u003c/code\u003e, which serves unary requests through the \u003ccode\u003e{:read_full_body, ref, pid}\u003c/code\u003e clause of \u003ccode\u003e\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3\u003c/code\u003e. The \u003ccode\u003e{:read_body, ref, pid}\u003c/code\u003e clause, which serves streaming requests, returns each chunk to the caller with no size check.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Unbounded buffering\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003e\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1\u003c/code\u003e reads chunks through that clause and appends each one to a binary buffer. It emits a message only when \u003ccode\u003eGRPC.Message.get_message/1\u003c/code\u003e finds a complete length-prefixed gRPC message in the buffer. Until then, the buffer grows with every chunk.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Memory exhaustion\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eA client that declares a large message length and keeps sending DATA frames without \u003ccode\u003eEND_STREAM\u003c/code\u003e makes the buffer grow without limit. The BEAM eventually runs out of memory and the node crashes.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. The cap applies to unary reads only**\n\nThe commit that added `max_body_size` checks it in `read_full_body/4`, which serves unary requests through the `{:read_full_body, ref, pid}` clause of `\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3`. The `{:read_body, ref, pid}` clause, which serves streaming requests, returns each chunk to the caller with no size check.\n\n**2. Unbounded buffering**\n\n`\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1` reads chunks through that clause and appends each one to a binary buffer. It emits a message only when `GRPC.Message.get_message/1` finds a complete length-prefixed gRPC message in the buffer. Until then, the buffer grows with every chunk.\n\n**3. Memory exhaustion**\n\nA client that declares a large message length and keeps sending DATA frames without `END_STREAM` makes the buffer grow without limit. The BEAM eventually runs out of memory and the node crashes."
}
],
"value": "1. The cap applies to unary reads only\n\nThe commit that added max_body_size checks it in read_full_body/4, which serves unary requests through the {:read_full_body, ref, pid} clause of \u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3. The {:read_body, ref, pid} clause, which serves streaming requests, returns each chunk to the caller with no size check.\n\n2. Unbounded buffering\n\n\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1 reads chunks through that clause and appends each one to a binary buffer. It emits a message only when GRPC.Message.get_message/1 finds a complete length-prefixed gRPC message in the buffer. Until then, the buffer grows with every chunk.\n\n3. Memory exhaustion\n\nA client that declares a large message length and keeps sending DATA frames without END_STREAM makes the buffer grow without limit. The BEAM eventually runs out of memory and the node crashes."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-71397",
"datePublished": "2026-11-06T21:02:03.676Z",
"dateReserved": "2026-08-19T10:30:01.929Z",
"dateUpdated": "2026-11-10T14:17:05.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53430 (GCVE-0-2026-53430)
Vulnerability from nvd – Published: 2026-06-15 21:55 – Updated: 2026-06-17 04:46
VLAI
EPSS
VEX
Title
grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1
Summary
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Message modules) allows a denial of service via a gzip decompression bomb.
This vulnerability is associated with program files lib/grpc/compressor/gzip.ex, lib/grpc/message.ex and program routines 'Elixir.GRPC.Compressor.Gzip':decompress/1, 'Elixir.GRPC.Message':from_data/2.
'Elixir.GRPC.Compressor.Gzip':decompress/1 calls :zlib.gunzip/1 directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip GRPC.Compressor implementation, it is invoked automatically whenever an incoming gRPC frame carries the grpc-encoding: gzip header. :zlib.gunzip/1 allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The max_receive_message_length limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node's heap and trigger an out-of-memory kill.
This issue affects grpc: from 0.4.0 before 1.0.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 14:42 UTC
CWE
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-53430.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-53430 | related |
| https://github.com/elixir-grpc/grpc/commit/1afbab… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc |
Affected:
0.4.0 , < 1.0.0
(semver)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
beae6800fc8baf126f3fe7107d86a50e105275ba , < 1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc
(git)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53430",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T14:42:39.467618Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T14:43:11.143Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Compressor.Gzip\u0027",
"\u0027Elixir.GRPC.Message\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/compressor/gzip.ex",
"lib/grpc/message.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Compressor.Gzip\u0027:decompress/1"
},
{
"name": "\u0027Elixir.GRPC.Message\u0027:from_data/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.4.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Compressor.Gzip\u0027",
"\u0027Elixir.GRPC.Message\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/compressor/gzip.ex",
"lib/grpc/message.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Compressor.Gzip\u0027:decompress/1"
},
{
"name": "\u0027Elixir.GRPC.Message\u0027:from_data/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc",
"status": "affected",
"version": "beae6800fc8baf126f3fe7107d86a50e105275ba",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (\u003ctt\u003eGRPC.Compressor.Gzip\u003c/tt\u003e, \u003ctt\u003eGRPC.Message\u003c/tt\u003e modules) allows a denial of service via a gzip decompression bomb.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/grpc/compressor/gzip.ex\u003c/tt\u003e, \u003ctt\u003elib/grpc/message.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.GRPC.Compressor.Gzip\u0027:decompress/1\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.GRPC.Message\u0027:from_data/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003e\u003ctt\u003e\u0027Elixir.GRPC.Compressor.Gzip\u0027:decompress/1\u003c/tt\u003e calls \u003ctt\u003e:zlib.gunzip/1\u003c/tt\u003e directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip \u003ctt\u003eGRPC.Compressor\u003c/tt\u003e implementation, it is invoked automatically whenever an incoming gRPC frame carries the \u003ctt\u003egrpc-encoding: gzip\u003c/tt\u003e header. \u003ctt\u003e:zlib.gunzip/1\u003c/tt\u003e allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The \u003ctt\u003emax_receive_message_length\u003c/tt\u003e limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node\u0027s heap and trigger an out-of-memory kill.\u003c/p\u003e\u003cp\u003eThis issue affects grpc: from 0.4.0 before 1.0.0.\u003c/p\u003e"
}
],
"value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Message modules) allows a denial of service via a gzip decompression bomb.\n\nThis vulnerability is associated with program files lib/grpc/compressor/gzip.ex, lib/grpc/message.ex and program routines \u0027Elixir.GRPC.Compressor.Gzip\u0027:decompress/1, \u0027Elixir.GRPC.Message\u0027:from_data/2.\n\n\u0027Elixir.GRPC.Compressor.Gzip\u0027:decompress/1 calls :zlib.gunzip/1 directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip GRPC.Compressor implementation, it is invoked automatically whenever an incoming gRPC frame carries the grpc-encoding: gzip header. :zlib.gunzip/1 allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The max_receive_message_length limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node\u0027s heap and trigger an out-of-memory kill.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T04:46:39.180Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-53430.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-53430"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-53430",
"datePublished": "2026-06-15T21:55:33.707Z",
"dateReserved": "2026-06-09T11:01:47.529Z",
"dateUpdated": "2026-06-17T04:46:39.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48854 (GCVE-0-2026-48854)
Vulnerability from nvd – Published: 2026-06-15 21:55 – Updated: 2026-09-24 21:09
VLAI
EPSS
VEX
Title
Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc
Summary
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body.
'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3 (lib/grpc/server/adapters/cowboy/handler.ex) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the grpc-timeout header, the per-chunk read timeout resolves to :infinity, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node.
This issue affects grpc: from 0.3.0-alpha.2 before 1.0.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 14:47 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-48854.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-48854 | related |
| https://github.com/elixir-grpc/grpc/commit/d1abe7… | related |
| https://github.com/elixir-grpc/grpc/commit/49e18c… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc |
Affected:
0.3.0-alpha.2 , < 1.0.0
(semver)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
d1abe70a6cad6dac4a3f8235d883d7c896989560 , < 49e18c3ec6bb9afe2f712caad3dbab5c56a68a00
(git)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
Date Public
2026-06-15 21:55
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48854",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T14:47:02.881535Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T14:47:28.479Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-q8gf-9rvj-gmgj"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:read_full_body/3"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.3.0-alpha.2",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:read_full_body/3"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "49e18c3ec6bb9afe2f712caad3dbab5c56a68a00",
"status": "affected",
"version": "d1abe70a6cad6dac4a3f8235d883d7c896989560",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.3.0-alpha.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"datePublic": "2026-06-15T21:55:23.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM\u0027s memory and crash the server by streaming a large or slow-trickle unary request body.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003e\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:read_full_body/3\u003c/code\u003e (\u003ccode\u003elib/grpc/server/adapters/cowboy/handler.ex\u003c/code\u003e) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the \u003ccode\u003egrpc-timeout\u003c/code\u003e header, the per-chunk read timeout resolves to \u003ccode\u003e:infinity\u003c/code\u003e, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc: from 0.3.0-alpha.2 before 1.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM\u0027s memory and crash the server by streaming a large or slow-trickle unary request body.\n\n`\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:read_full_body/3` (`lib/grpc/server/adapters/cowboy/handler.ex`) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the `grpc-timeout` header, the per-chunk read timeout resolves to `:infinity`, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node.\n\nThis issue affects grpc: from 0.3.0-alpha.2 before 1.0.0."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM\u0027s memory and crash the server by streaming a large or slow-trickle unary request body.\n\n\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:read_full_body/3 (lib/grpc/server/adapters/cowboy/handler.ex) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the grpc-timeout header, the per-chunk read timeout resolves to :infinity, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node.\n\nThis issue affects grpc: from 0.3.0-alpha.2 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
},
{
"capecId": "CAPEC-231",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-231 Oversized Serialized Data Payloads"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T21:09:30.485Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-q8gf-9rvj-gmgj"
},
{
"name": "EEF CNA record for CVE-2026-48854",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48854.html"
},
{
"name": "OSV record EEF-CVE-2026-48854",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48854"
},
{
"name": "Introducing commit d1abe70 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/d1abe70a6cad6dac4a3f8235d883d7c896989560"
},
{
"name": "Fix commit 49e18c3 in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/49e18c3ec6bb9afe2f712caad3dbab5c56a68a00"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-48854",
"datePublished": "2026-06-15T21:55:23.629Z",
"dateReserved": "2026-05-25T20:44:10.697Z",
"dateUpdated": "2026-09-24T21:09:30.485Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48853 (GCVE-0-2026-48853)
Vulnerability from nvd – Published: 2026-06-15 21:56 – Updated: 2026-09-24 21:08
VLAI
EPSS
VEX
Title
Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc
Summary
Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.
'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.
This issue affects grpc: from 0.4.0 before 1.0.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 14:44 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-48853.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-48853 | related |
| https://github.com/elixir-grpc/grpc/commit/25bcc5… | related |
| https://github.com/elixir-grpc/grpc/commit/272a97… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc |
Affected:
0.4.0 , < 1.0.0
(semver)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
25bcc569fe2cc4478531a6c546c923205fc751c9 , < 272a97a5ea1b46af1819f14a831fcf35fc91f992
(git)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
Date Public
2026-06-15 21:56
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48853",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T14:44:19.175606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T14:45:02.196Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Codec.Erlpack\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.4.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Codec.Erlpack\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "272a97a5ea1b46af1819f14a831fcf35fc91f992",
"status": "affected",
"version": "25bcc569fe2cc4478531a6c546c923205fc751c9",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003ccode\u003eGRPC.Codec.Erlpack\u003c/code\u003e must be explicitly registered as a codec on the gRPC server.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "`GRPC.Codec.Erlpack` must be explicitly registered as a codec on the gRPC server."
}
],
"value": "GRPC.Codec.Erlpack must be explicitly registered as a codec on the gRPC server."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"datePublic": "2026-06-15T21:56:15.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDeserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003e\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2\u003c/code\u003e (\u003ccode\u003elib/grpc/codec/erlpack.ex\u003c/code\u003e) calls \u003ccode\u003e:erlang.binary_to_term/1\u003c/code\u003e on the raw gRPC message body without the \u003ccode\u003e:safe\u003c/code\u003e option, no size bound, and no type guard. Any unauthenticated peer that sends a request with \u003ccode\u003eContent-Type: application/grpc+erlpack\u003c/code\u003e can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc: from 0.4.0 before 1.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.\n\n`\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2` (`lib/grpc/codec/erlpack.ex`) calls `:erlang.binary_to_term/1` on the raw gRPC message body without the `:safe` option, no size bound, and no type guard. Any unauthenticated peer that sends a request with `Content-Type: application/grpc+erlpack` can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0."
}
],
"value": "Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.\n\n\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
},
{
"capecId": "CAPEC-231",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-231 Oversized Serialized Data Payloads"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T21:08:47.457Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h"
},
{
"name": "EEF CNA record for CVE-2026-48853",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48853.html"
},
{
"name": "OSV record EEF-CVE-2026-48853",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48853"
},
{
"name": "Introducing commit 25bcc56 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/25bcc569fe2cc4478531a6c546c923205fc751c9"
},
{
"name": "Fix commit 272a97a in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-48853",
"datePublished": "2026-06-15T21:56:15.262Z",
"dateReserved": "2026-05-25T20:44:10.696Z",
"dateUpdated": "2026-09-24T21:08:47.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48599 (GCVE-0-2026-48599)
Vulnerability from nvd – Published: 2026-06-15 21:55 – Updated: 2026-09-24 21:04
VLAI
EPSS
VEX
Title
Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding
Summary
Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.
In 'Elixir.GRPC.Server.Transcode':map_request/5 (lib/grpc/server/transcode.ex), all three clauses use Map.merge/2 with path bindings as the first argument, giving them the lowest merge precedence. A request such as GET /users/me/profile?user_id=victim (or a POST with {"user_id": "victim"} when body: "*") yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.
This issue affects grpc: from 0.8.0 before 1.0.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 14:45 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-48599.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-48599 | related |
| https://github.com/elixir-grpc/grpc/commit/8aaf3d… | related |
| https://github.com/elixir-grpc/grpc/commit/33b6a0… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc |
Affected:
0.8.0 , < 1.0.0
(semver)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048 , < 33b6a095dbc91c6dee3c7b90893d7d74952e82e4
(git)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
Date Public
2026-06-15 21:55
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48599",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T14:45:46.288762Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T14:46:09.673Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Transcode\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/transcode.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.8.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Transcode\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/transcode.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "33b6a095dbc91c6dee3c7b90893d7d74952e82e4",
"status": "affected",
"version": "8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eHTTP-to-gRPC transcoding must be enabled.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "HTTP-to-gRPC transcoding must be enabled."
}
],
"value": "HTTP-to-gRPC transcoding must be enabled."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.8.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"datePublic": "2026-06-15T21:55:28.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.\u003c/p\u003e\n\u003cp\u003eIn \u003ccode\u003e\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5\u003c/code\u003e (\u003ccode\u003elib/grpc/server/transcode.ex\u003c/code\u003e), all three clauses use \u003ccode\u003eMap.merge/2\u003c/code\u003e with path bindings as the first argument, giving them the lowest merge precedence. A request such as \u003ccode\u003eGET /users/me/profile?user_id=victim\u003c/code\u003e (or a POST with \u003ccode\u003e{\"user_id\": \"victim\"}\u003c/code\u003e when \u003ccode\u003ebody: \"*\"\u003c/code\u003e) yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc: from 0.8.0 before 1.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.\n\nIn `\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5` (`lib/grpc/server/transcode.ex`), all three clauses use `Map.merge/2` with path bindings as the first argument, giving them the lowest merge precedence. A request such as `GET /users/me/profile?user_id=victim` (or a POST with `{\"user_id\": \"victim\"}` when `body: \"*\"`) yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.\n\nThis issue affects grpc: from 0.8.0 before 1.0.0."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.\n\nIn \u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5 (lib/grpc/server/transcode.ex), all three clauses use Map.merge/2 with path bindings as the first argument, giving them the lowest merge precedence. A request such as GET /users/me/profile?user_id=victim (or a POST with {\"user_id\": \"victim\"} when body: \"*\") yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.\n\nThis issue affects grpc: from 0.8.0 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-460",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-460 HTTP Parameter Pollution (HPP)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T21:04:08.766Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq"
},
{
"name": "EEF CNA record for CVE-2026-48599",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48599.html"
},
{
"name": "OSV record EEF-CVE-2026-48599",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48599"
},
{
"name": "Introducing commit 8aaf3d3 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048"
},
{
"name": "Fix commit 33b6a09 in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-48599",
"datePublished": "2026-06-15T21:55:28.702Z",
"dateReserved": "2026-05-22T09:36:56.834Z",
"dateUpdated": "2026-09-24T21:04:08.766Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124279 (GCVE-0-2026-124279)
Vulnerability from cvelistv5 – Published: 2026-11-13 16:18 – Updated: 2026-11-13 19:32
VLAI
EPSS
VEX
Title
Streaming request body limit enforced only after an 8 MB read in elixir-grpc grpc_server
Summary
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests.
The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with max_body_size only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all.
This issue affects grpc_server: from 1.0.0 before 1.1.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:55 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-124279.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-124279 | related |
| https://github.com/elixir-grpc/grpc/commit/49e18c… | related |
| https://github.com/elixir-grpc/grpc/commit/b1e771… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc_server |
Affected:
1.0.0 , < 1.1.0
(semver)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc_server |
Affected:
49e18c3ec6bb9afe2f712caad3dbab5c56a68a00 , < b1e771d558941b1ed4b6de8b39f6a5375543db01
(git)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124279",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:55:00.516542Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T19:32:24.719Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "grpc_server",
"packageURL": "pkg:hex/grpc_server",
"product": "grpc_server",
"programFiles": [
"lib/grpc/server/adapters/cowboy/handler.ex",
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_server",
"programFiles": [
"grpc_server/lib/grpc/server/adapters/cowboy/handler.ex",
"grpc_server/lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "b1e771d558941b1ed4b6de8b39f6a5375543db01",
"status": "affected",
"version": "49e18c3ec6bb9afe2f712caad3dbab5c56a68a00",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe server must expose at least one client-streaming or bidirectional-streaming RPC method.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."
}
],
"value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Alfie Goh Li Heng"
},
{
"lang": "en",
"type": "finder",
"value": "Alfie Goh Li Heng"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-11-13T11:19:13.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests.\u003c/p\u003e\n\u003cp\u003eThe streaming read clause of \u003ccode\u003eGRPC.Server.Adapters.Cowboy.Handler.info/3\u003c/code\u003e (\u003ccode\u003egrpc_server/lib/grpc/server/adapters/cowboy/handler.ex\u003c/code\u003e) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with \u003ccode\u003emax_body_size\u003c/code\u003e only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc_server: from 1.0.0 before 1.1.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests.\n\nThe streaming read clause of `GRPC.Server.Adapters.Cowboy.Handler.info/3` (`grpc_server/lib/grpc/server/adapters/cowboy/handler.ex`) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with `max_body_size` only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests.\n\nThe streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with max_body_size only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated client that opens many streaming calls can make the server buffer more request data than its configured limit allows and crash the node, taking down every service on it.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated client that opens many streaming calls can make the server buffer more request data than its configured limit allows and crash the node, taking down every service on it."
}
],
"value": "An unauthenticated client that opens many streaming calls can make the server buffer more request data than its configured limit allows and crash the node, taking down every service on it."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T16:18:56.700Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Streaming request body limit enforced only after an 8 MB read in elixir-grpc grpc_server",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-736x-r87j-jhcm"
},
{
"name": "EEF CNA record for CVE-2026-124279",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-124279.html"
},
{
"name": "OSV record EEF-CVE-2026-124279",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-124279"
},
{
"name": "Introducing commit 49e18c3 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/49e18c3ec6bb9afe2f712caad3dbab5c56a68a00"
},
{
"name": "Fix commit b1e771d in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/b1e771d558941b1ed4b6de8b39f6a5375543db01"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Streaming request body limit enforced only after an 8 MB read in elixir-grpc grpc_server",
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Large reads\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003easync_read_body/2\u003c/code\u003e asks Cowboy for up to 8,000,000 bytes per read on the streaming path, whatever \u003ccode\u003emax_body_size\u003c/code\u003e is set to.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. The limit is checked after the read\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003etrack_body_bytes/2\u003c/code\u003e adds each returned chunk to a running total and refuses the stream with \u003ccode\u003eRESOURCE_EXHAUSTED\u003c/code\u003e only once the total exceeds \u003ccode\u003emax_body_size\u003c/code\u003e. By then the whole chunk is in memory.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. No check on the length prefix\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe 5-byte gRPC prefix can declare up to 4 GiB. The server does not compare it with any limit before buffering, so a prefix that declares an oversized message does not stop the read.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4. Result\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eEach client-streaming or bidirectional-streaming call can make the server hold several megabytes more than the configured limit, and the attacker can open many such calls at once. Before 1.0.6 the streaming path had no limit, and \u003ccode\u003eGRPC.Server.Adapters.Cowboy.reading_stream/1\u003c/code\u003e buffered the whole body.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Large reads**\n\n`async_read_body/2` asks Cowboy for up to 8,000,000 bytes per read on the streaming path, whatever `max_body_size` is set to.\n\n**2. The limit is checked after the read**\n\n`track_body_bytes/2` adds each returned chunk to a running total and refuses the stream with `RESOURCE_EXHAUSTED` only once the total exceeds `max_body_size`. By then the whole chunk is in memory.\n\n**3. No check on the length prefix**\n\nThe 5-byte gRPC prefix can declare up to 4 GiB. The server does not compare it with any limit before buffering, so a prefix that declares an oversized message does not stop the read.\n\n**4. Result**\n\nEach client-streaming or bidirectional-streaming call can make the server hold several megabytes more than the configured limit, and the attacker can open many such calls at once. Before 1.0.6 the streaming path had no limit, and `GRPC.Server.Adapters.Cowboy.reading_stream/1` buffered the whole body."
}
],
"value": "1. Large reads\n\nasync_read_body/2 asks Cowboy for up to 8,000,000 bytes per read on the streaming path, whatever max_body_size is set to.\n\n2. The limit is checked after the read\n\ntrack_body_bytes/2 adds each returned chunk to a running total and refuses the stream with RESOURCE_EXHAUSTED only once the total exceeds max_body_size. By then the whole chunk is in memory.\n\n3. No check on the length prefix\n\nThe 5-byte gRPC prefix can declare up to 4 GiB. The server does not compare it with any limit before buffering, so a prefix that declares an oversized message does not stop the read.\n\n4. Result\n\nEach client-streaming or bidirectional-streaming call can make the server hold several megabytes more than the configured limit, and the attacker can open many such calls at once. Before 1.0.6 the streaming path had no limit, and GRPC.Server.Adapters.Cowboy.reading_stream/1 buffered the whole body."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-124279",
"datePublished": "2026-11-13T16:18:56.700Z",
"dateReserved": "2026-11-13T11:18:43.141Z",
"dateUpdated": "2026-11-13T19:32:24.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121809 (GCVE-0-2026-121809)
Vulnerability from cvelistv5 – Published: 2026-11-13 16:18 – Updated: 2026-11-13 19:32
VLAI
EPSS
VEX
Title
CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server
Summary
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.
GRPC.Server.Adapters.Cowboy.read_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with END_STREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.
This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:55 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-121809.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-121809 | related |
| https://github.com/elixir-grpc/grpc/commit/0332fa… | related |
| https://github.com/elixir-grpc/grpc/commit/38955f… | patch |
| https://github.com/elixir-grpc/grpc/commit/6d8a09… | related |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc_server |
Affected:
1.0.0 , < 1.1.0
(semver)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc_server |
Affected:
0332faae5f5e132314794dbfdae5edecbccea292 , < 38955f1392cbf08eef231a347348445410455c85
(git)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
0.3.1 , < 1.0.0
(semver)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
6d8a09ad919e208fb600538ac8b19bd733a04310 , < 0332faae5f5e132314794dbfdae5edecbccea292
(git)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121809",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:55:12.226355Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T19:32:40.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "grpc_server",
"packageURL": "pkg:hex/grpc_server",
"product": "grpc_server",
"programFiles": [
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_server",
"programFiles": [
"grpc_server/lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "38955f1392cbf08eef231a347348445410455c85",
"status": "affected",
"version": "0332faae5f5e132314794dbfdae5edecbccea292",
"versionType": "git"
}
]
},
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.3.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "0332faae5f5e132314794dbfdae5edecbccea292",
"status": "affected",
"version": "6d8a09ad919e208fb600538ac8b19bd733a04310",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe server must expose at least one client-streaming or bidirectional-streaming RPC method.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."
}
],
"value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Adam Jordan"
},
{
"lang": "en",
"type": "finder",
"value": "Adam Jordan"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Marko Vejnovic"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-11-13T11:19:46.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eLoop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eGRPC.Server.Adapters.Cowboy.read_stream/1\u003c/code\u003e (\u003ccode\u003egrpc_server/lib/grpc/server/adapters/cowboy.ex\u003c/code\u003e, and the Cowboy adapter in \u003ccode\u003egrpc\u003c/code\u003e before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with \u003ccode\u003eEND_STREAM\u003c/code\u003e keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.\n\n`GRPC.Server.Adapters.Cowboy.read_stream/1` (`grpc_server/lib/grpc/server/adapters/cowboy.ex`, and the Cowboy adapter in `grpc` before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with `END_STREAM` keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0."
}
],
"value": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.\n\nGRPC.Server.Adapters.Cowboy.read_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with END_STREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated client can keep one scheduler busy per open connection with a 5-byte request, and enough connections deny service to every application on the node.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated client can keep one scheduler busy per open connection with a 5-byte request, and enough connections deny service to every application on the node."
}
],
"value": "An unauthenticated client can keep one scheduler busy per open connection with a 5-byte request, and enough connections deny service to every application on the node."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with Unreachable Exit Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T16:18:37.954Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-c2h9-f9cc-27xh"
},
{
"name": "EEF CNA record for CVE-2026-121809",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-121809.html"
},
{
"name": "OSV record EEF-CVE-2026-121809",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-121809"
},
{
"name": "Introducing commit 0332faa in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
},
{
"name": "Fix commit 38955f1 in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/38955f1392cbf08eef231a347348445410455c85"
},
{
"name": "Introducing commit 6d8a09a in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/6d8a09ad919e208fb600538ac8b19bd733a04310"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server",
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eStart a server that exposes a client-streaming RPC, for example \u003ccode\u003eRouteGuide.RecordRoute\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOpen an HTTP/2 connection and send \u003ccode\u003eHEADERS\u003c/code\u003e for that method with \u003ccode\u003econtent-type: application/grpc\u003c/code\u003e and no \u003ccode\u003egrpc-timeout\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend one \u003ccode\u003eDATA\u003c/code\u003e frame with \u003ccode\u003eEND_STREAM\u003c/code\u003e that holds only the 5-byte prefix \u003ccode\u003e00 00 00 00 64\u003c/code\u003e, which declares a 100-byte message.\u003c/li\u003e\n\u003cli\u003eKeep the connection open and observe that no response arrives and one BEAM scheduler stays at 100% CPU until the connection closes.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a server that exposes a client-streaming RPC, for example `RouteGuide.RecordRoute`.\n2. Open an HTTP/2 connection and send `HEADERS` for that method with `content-type: application/grpc` and no `grpc-timeout`.\n3. Send one `DATA` frame with `END_STREAM` that holds only the 5-byte prefix `00 00 00 00 64`, which declares a 100-byte message.\n4. Keep the connection open and observe that no response arrives and one BEAM scheduler stays at 100% CPU until the connection closes."
}
],
"value": "* Start a server that exposes a client-streaming RPC, for example RouteGuide.RecordRoute.\n* Open an HTTP/2 connection and send HEADERS for that method with content-type: application/grpc and no grpc-timeout.\n* Send one DATA frame with END_STREAM that holds only the 5-byte prefix 00 00 00 00 64, which declares a 100-byte message.\n* Keep the connection open and observe that no response arrives and one BEAM scheduler stays at 100% CPU until the connection closes."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. A partial message\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eA client sends a 5-byte gRPC length prefix that declares more bytes than follow it, and ends the request body with \u003ccode\u003eEND_STREAM\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. The reader asks for more\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eread_stream/1\u003c/code\u003e calls \u003ccode\u003eGRPC.Message.get_message/1\u003c/code\u003e, which returns \u003ccode\u003efalse\u003c/code\u003e because the declared message is incomplete. \u003ccode\u003eread_stream/1\u003c/code\u003e then sets \u003ccode\u003eneed_more\u003c/code\u003e and reads again through \u003ccode\u003eHandler.read_body/1\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Every read is empty\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eOnce the body has been read, the handler\u0027s \u003ccode\u003easync_read_body/2\u003c/code\u003e (and \u003ccode\u003ecowboy_req:read_body/2\u003c/code\u003e in older releases) returns an empty chunk at once. The buffer stays the same, the exit clause for an empty finished buffer never matches, and the loop repeats.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4. No timeout ends it\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eEach iteration is a message round trip between two local processes, not a socket wait, so no I/O timeout applies. Without a \u003ccode\u003egrpc-timeout\u003c/code\u003e header there is no deadline, and the adapter\u0027s idle timeout defaults to \u003ccode\u003e:infinity\u003c/code\u003e. One scheduler stays at full load until the client closes the connection.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. A partial message**\n\nA client sends a 5-byte gRPC length prefix that declares more bytes than follow it, and ends the request body with `END_STREAM`.\n\n**2. The reader asks for more**\n\n`read_stream/1` calls `GRPC.Message.get_message/1`, which returns `false` because the declared message is incomplete. `read_stream/1` then sets `need_more` and reads again through `Handler.read_body/1`.\n\n**3. Every read is empty**\n\nOnce the body has been read, the handler\u0027s `async_read_body/2` (and `cowboy_req:read_body/2` in older releases) returns an empty chunk at once. The buffer stays the same, the exit clause for an empty finished buffer never matches, and the loop repeats.\n\n**4. No timeout ends it**\n\nEach iteration is a message round trip between two local processes, not a socket wait, so no I/O timeout applies. Without a `grpc-timeout` header there is no deadline, and the adapter\u0027s idle timeout defaults to `:infinity`. One scheduler stays at full load until the client closes the connection."
}
],
"value": "1. A partial message\n\nA client sends a 5-byte gRPC length prefix that declares more bytes than follow it, and ends the request body with END_STREAM.\n\n2. The reader asks for more\n\nread_stream/1 calls GRPC.Message.get_message/1, which returns false because the declared message is incomplete. read_stream/1 then sets need_more and reads again through Handler.read_body/1.\n\n3. Every read is empty\n\nOnce the body has been read, the handler\u0027s async_read_body/2 (and cowboy_req:read_body/2 in older releases) returns an empty chunk at once. The buffer stays the same, the exit clause for an empty finished buffer never matches, and the loop repeats.\n\n4. No timeout ends it\n\nEach iteration is a message round trip between two local processes, not a socket wait, so no I/O timeout applies. Without a grpc-timeout header there is no deadline, and the adapter\u0027s idle timeout defaults to :infinity. One scheduler stays at full load until the client closes the connection."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-121809",
"datePublished": "2026-11-13T16:18:37.954Z",
"dateReserved": "2026-11-13T11:19:13.834Z",
"dateUpdated": "2026-11-13T19:32:40.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124278 (GCVE-0-2026-124278)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:58 – Updated: 2026-11-13 15:58
VLAI
EPSS
VEX
Title
Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server
Summary
Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.
Only the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.
This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-124278.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-124278 | related |
| https://github.com/elixir-grpc/grpc/commit/0332fa… | related |
| https://github.com/elixir-grpc/grpc/commit/953ab9… | patch |
| https://github.com/elixir-grpc/grpc/commit/8aaf3d… | related |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc_server |
Affected:
1.0.0 , < 1.1.0
(semver)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc_server |
Affected:
0332faae5f5e132314794dbfdae5edecbccea292 , < 953ab980d8a127e895d3ab9505fc4b9337bb32f7
(git)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
0.8.0 , < 1.0.0
(semver)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048 , < 0332faae5f5e132314794dbfdae5edecbccea292
(git)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027"
],
"packageName": "grpc_server",
"packageURL": "pkg:hex/grpc_server",
"product": "grpc_server",
"programFiles": [
"lib/grpc/server.ex",
"lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server\u0027:do_handle_request/4"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:init/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_server",
"programFiles": [
"grpc_server/lib/grpc/server.ex",
"grpc_server/lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server\u0027:do_handle_request/4"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:init/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "953ab980d8a127e895d3ab9505fc4b9337bb32f7",
"status": "affected",
"version": "0332faae5f5e132314794dbfdae5edecbccea292",
"versionType": "git"
}
]
},
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server.ex",
"lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server\u0027:do_handle_request/4"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:init/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.8.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server.ex",
"lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server\u0027:do_handle_request/4"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:init/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "0332faae5f5e132314794dbfdae5edecbccea292",
"status": "affected",
"version": "8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eHTTP-to-gRPC transcoding must be enabled with \u003ccode\u003ehttp_transcode: true\u003c/code\u003e. Access to a resource must be decided from the URL path rather than from the decoded request, for example by an API gateway, proxy rule or WAF in front of the server.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "HTTP-to-gRPC transcoding must be enabled with `http_transcode: true`. Access to a resource must be decided from the URL path rather than from the decoded request, for example by an API gateway, proxy rule or WAF in front of the server."
}
],
"value": "HTTP-to-gRPC transcoding must be enabled with http_transcode: true. Access to a resource must be decided from the URL path rather than from the decoded request, for example by an API gateway, proxy rule or WAF in front of the server."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.8.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eurico Nicacio"
},
{
"lang": "en",
"type": "finder",
"value": "Eurico Nicacio"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-11-13T11:18:41.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.\u003c/p\u003e\n\u003cp\u003eOnly the transcoding clause of \u003ccode\u003eGRPC.Server.do_handle_request/4\u003c/code\u003e (\u003ccode\u003egrpc_server/lib/grpc/server.ex\u003c/code\u003e, and \u003ccode\u003elib/grpc/server.ex\u003c/code\u003e before the package split) applies the route\u0027s path bindings to the request message. The Cowboy handler picks that clause from the request \u003ccode\u003eContent-Type\u003c/code\u003e, not from the route. A request to a transcoded URL with \u003ccode\u003eapplication/grpc\u003c/code\u003e or \u003ccode\u003eapplication/grpc-web\u003c/code\u003e is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.\n\nOnly the transcoding clause of `GRPC.Server.do_handle_request/4` (`grpc_server/lib/grpc/server.ex`, and `lib/grpc/server.ex` before the package split) applies the route\u0027s path bindings to the request message. The Cowboy handler picks that clause from the request `Content-Type`, not from the route. A request to a transcoded URL with `application/grpc` or `application/grpc-web` is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.\n\nOnly the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route\u0027s path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-460",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant\u0027s data.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant\u0027s data."
}
],
"value": "An attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant\u0027s data."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "CWE-436 Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:58:08.134Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xc5v-89vq-hv5m"
},
{
"name": "EEF CNA record for CVE-2026-124278",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-124278.html"
},
{
"name": "OSV record EEF-CVE-2026-124278",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-124278"
},
{
"name": "Introducing commit 0332faa in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
},
{
"name": "Fix commit 953ab98 in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/953ab980d8a127e895d3ab9505fc4b9337bb32f7"
},
{
"name": "Introducing commit 8aaf3d3 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server",
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eStart a server with \u003ccode\u003ehttp_transcode: true\u003c/code\u003e and a transcoded route that binds a field from the path, for example \u003ccode\u003eGET /v1/messages/{name}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eBuild a gRPC frame whose message sets \u003ccode\u003ename\u003c/code\u003e to \u003ccode\u003evictim\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend it over HTTP/1.1 as \u003ccode\u003eGET /v1/messages/alice\u003c/code\u003e with \u003ccode\u003eContent-Type: application/grpc\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eObserve that the handler receives \u003ccode\u003ename\u003c/code\u003e set to \u003ccode\u003evictim\u003c/code\u003e, not \u003ccode\u003ealice\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a server with `http_transcode: true` and a transcoded route that binds a field from the path, for example `GET /v1/messages/{name}`.\n2. Build a gRPC frame whose message sets `name` to `victim`.\n3. Send it over HTTP/1.1 as `GET /v1/messages/alice` with `Content-Type: application/grpc`.\n4. Observe that the handler receives `name` set to `victim`, not `alice`."
}
],
"value": "* Start a server with http_transcode: true and a transcoded route that binds a field from the path, for example GET /v1/messages/{name}.\n* Build a gRPC frame whose message sets name to victim.\n* Send it over HTTP/1.1 as GET /v1/messages/alice with Content-Type: application/grpc.\n* Observe that the handler receives name set to victim, not alice."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. The header selects the clause\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe Cowboy handler derives the access mode from the request \u003ccode\u003eContent-Type\u003c/code\u003e. \u003ccode\u003eapplication/json\u003c/code\u003e selects \u003ccode\u003e:http_transcoding\u003c/code\u003e, \u003ccode\u003eapplication/grpc\u003c/code\u003e selects \u003ccode\u003e:grpc\u003c/code\u003e and \u003ccode\u003eapplication/grpc-web+proto\u003c/code\u003e selects \u003ccode\u003e:grpcweb\u003c/code\u003e. The router still matches the transcoded URL template and extracts its path bindings.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Bindings are applied in one clause only\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eGRPC.Server.do_handle_request/4\u003c/code\u003e reads the bindings with \u003ccode\u003eadapter.get_bindings/1\u003c/code\u003e and merges them through \u003ccode\u003eGRPC.Server.Transcode.map_request/5\u003c/code\u003e only in the \u003ccode\u003e:http_transcoding\u003c/code\u003e clause. The unary and request-streaming clauses decode the body alone with the selected codec. \u003ccode\u003eGRPC.Codec.Proto\u003c/code\u003e is in the default codecs of every server, so \u003ccode\u003eapplication/grpc\u003c/code\u003e is always accepted.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. The HTTP/1.1 guard never matches\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eresolve_access_mode/3\u003c/code\u003e has a clause that forces transcoding for HTTP/1.1 requests. It matches the version as the binary \u003ccode\u003e\"HTTP/1.1\"\u003c/code\u003e, while Cowboy stores the version as an atom, so the clause never applies and the request works over plain HTTP/1.1.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4. Result\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eA request to \u003ccode\u003e/v1/messages/alice\u003c/code\u003e with \u003ccode\u003eContent-Type: application/grpc\u003c/code\u003e and a message that sets \u003ccode\u003ename\u003c/code\u003e to \u003ccode\u003evictim\u003c/code\u003e reaches the handler with \u003ccode\u003ename\u003c/code\u003e set to \u003ccode\u003evictim\u003c/code\u003e. With an empty message the field is empty: the path binding is never consulted.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. The header selects the clause**\n\nThe Cowboy handler derives the access mode from the request `Content-Type`. `application/json` selects `:http_transcoding`, `application/grpc` selects `:grpc` and `application/grpc-web+proto` selects `:grpcweb`. The router still matches the transcoded URL template and extracts its path bindings.\n\n**2. Bindings are applied in one clause only**\n\n`GRPC.Server.do_handle_request/4` reads the bindings with `adapter.get_bindings/1` and merges them through `GRPC.Server.Transcode.map_request/5` only in the `:http_transcoding` clause. The unary and request-streaming clauses decode the body alone with the selected codec. `GRPC.Codec.Proto` is in the default codecs of every server, so `application/grpc` is always accepted.\n\n**3. The HTTP/1.1 guard never matches**\n\n`resolve_access_mode/3` has a clause that forces transcoding for HTTP/1.1 requests. It matches the version as the binary `\"HTTP/1.1\"`, while Cowboy stores the version as an atom, so the clause never applies and the request works over plain HTTP/1.1.\n\n**4. Result**\n\nA request to `/v1/messages/alice` with `Content-Type: application/grpc` and a message that sets `name` to `victim` reaches the handler with `name` set to `victim`. With an empty message the field is empty: the path binding is never consulted."
}
],
"value": "1. The header selects the clause\n\nThe Cowboy handler derives the access mode from the request Content-Type. application/json selects :http_transcoding, application/grpc selects :grpc and application/grpc-web+proto selects :grpcweb. The router still matches the transcoded URL template and extracts its path bindings.\n\n2. Bindings are applied in one clause only\n\nGRPC.Server.do_handle_request/4 reads the bindings with adapter.get_bindings/1 and merges them through GRPC.Server.Transcode.map_request/5 only in the :http_transcoding clause. The unary and request-streaming clauses decode the body alone with the selected codec. GRPC.Codec.Proto is in the default codecs of every server, so application/grpc is always accepted.\n\n3. The HTTP/1.1 guard never matches\n\nresolve_access_mode/3 has a clause that forces transcoding for HTTP/1.1 requests. It matches the version as the binary \"HTTP/1.1\", while Cowboy stores the version as an atom, so the clause never applies and the request works over plain HTTP/1.1.\n\n4. Result\n\nA request to /v1/messages/alice with Content-Type: application/grpc and a message that sets name to victim reaches the handler with name set to victim. With an empty message the field is empty: the path binding is never consulted."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-124278",
"datePublished": "2026-11-13T15:58:08.134Z",
"dateReserved": "2026-11-09T23:03:52.038Z",
"dateUpdated": "2026-11-13T15:58:08.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121808 (GCVE-0-2026-121808)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:48 – Updated: 2026-11-13 15:48
VLAI
EPSS
VEX
Title
Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codec
Summary
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.
GRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body.
This issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0.
Severity
CWE
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Assigner
References
6 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc |
Affected:
0.4.0 , < 1.0.0
(semver)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
25bcc569fe2cc4478531a6c546c923205fc751c9 , < 0332faae5f5e132314794dbfdae5edecbccea292
(git)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc_core |
Affected:
1.0.0 , < 1.1.0
(semver)
cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc_core |
Affected:
0332faae5f5e132314794dbfdae5edecbccea292 , < d6bc56ac75dfb6c02db2099909210a37c9be8db6
(git)
cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Codec.Erlpack\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.4.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Codec.Erlpack\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "0332faae5f5e132314794dbfdae5edecbccea292",
"status": "affected",
"version": "25bcc569fe2cc4478531a6c546c923205fc751c9",
"versionType": "git"
}
]
},
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Codec.Erlpack\u0027"
],
"packageName": "grpc_core",
"packageURL": "pkg:hex/grpc_core",
"product": "grpc_core",
"programFiles": [
"lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Codec.Erlpack\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_core",
"programFiles": [
"grpc_core/lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "d6bc56ac75dfb6c02db2099909210a37c9be8db6",
"status": "affected",
"version": "0332faae5f5e132314794dbfdae5edecbccea292",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003ccode\u003eGRPC.Codec.Erlpack\u003c/code\u003e must be explicitly registered as a codec on the gRPC server.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "`GRPC.Codec.Erlpack` must be explicitly registered as a codec on the gRPC server."
}
],
"value": "GRPC.Codec.Erlpack must be explicitly registered as a codec on the gRPC server."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jace"
},
{
"lang": "en",
"type": "finder",
"value": "zx"
},
{
"lang": "en",
"type": "reporter",
"value": "zx"
},
{
"lang": "en",
"type": "finder",
"value": "Jiacheng Zhong"
},
{
"lang": "en",
"type": "finder",
"value": "Zhun Wang"
},
{
"lang": "en",
"type": "finder",
"value": "Junmin Zhu"
},
{
"lang": "en",
"type": "finder",
"value": "Hongwei Li"
},
{
"lang": "en",
"type": "finder",
"value": "Han Dai"
},
{
"lang": "en",
"type": "finder",
"value": "Suyue Guo"
},
{
"lang": "en",
"type": "finder",
"value": "Songyang Peng"
},
{
"lang": "en",
"type": "finder",
"value": "Ziyue Pan"
},
{
"lang": "en",
"type": "reporter",
"value": "Hongwei Li"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "coordinator",
"value": "Peter Ullrich"
}
],
"dateAssigned": "2026-11-12T20:11:46.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eGRPC.Codec.Erlpack.decode/2\u003c/code\u003e (\u003ccode\u003egrpc_core/lib/grpc/codec/erlpack.ex\u003c/code\u003e, and \u003ccode\u003elib/grpc/codec/erlpack.ex\u003c/code\u003e before the package split) passes the message body to \u003ccode\u003e:erlang.binary_to_term/2\u003c/code\u003e. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server\u0027s \u003ccode\u003emax_body_size\u003c/code\u003e limit counts the compressed bytes of the request. A request with \u003ccode\u003eContent-Type: application/grpc+erlpack\u003c/code\u003e can therefore make the server allocate a term much larger than the request body.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.\n\n`GRPC.Codec.Erlpack.decode/2` (`grpc_core/lib/grpc/codec/erlpack.ex`, and `lib/grpc/codec/erlpack.ex` before the package split) passes the message body to `:erlang.binary_to_term/2`. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server\u0027s `max_body_size` limit counts the compressed bytes of the request. A request with `Content-Type: application/grpc+erlpack` can therefore make the server allocate a term much larger than the request body.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0."
}
],
"value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.\n\nGRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server\u0027s max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated client can make a server that registers the Erlpack codec allocate memory far beyond the size of the request with one request. Memory exhaustion affects every service on that node.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated client can make a server that registers the Erlpack codec allocate memory far beyond the size of the request with one request. Memory exhaustion affects every service on that node."
}
],
"value": "An unauthenticated client can make a server that registers the Erlpack codec allocate memory far beyond the size of the request with one request. Memory exhaustion affects every service on that node."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:48:49.871Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codec",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xxp9-7hp4-rqwp"
},
{
"name": "EEF CNA record for CVE-2026-121808",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-121808.html"
},
{
"name": "OSV record EEF-CVE-2026-121808",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-121808"
},
{
"name": "Introducing commit 25bcc56 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/25bcc569fe2cc4478531a6c546c923205fc751c9"
},
{
"name": "Fix commit 0332faa in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
},
{
"name": "Fix commit d6bc56a in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/d6bc56ac75dfb6c02db2099909210a37c9be8db6"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codec",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRemove \u003ccode\u003eGRPC.Codec.Erlpack\u003c/code\u003e from the server\u0027s \u003ccode\u003ecodecs\u003c/code\u003e list if the codec is not needed.\u003c/p\u003e\n\u003cp\u003eIf the codec is needed, register a wrapper codec in its place. The wrapper implements the \u003ccode\u003eGRPC.Codec\u003c/code\u003e behaviour, returns \u003ccode\u003e\"erlpack\"\u003c/code\u003e from \u003ccode\u003ename/0\u003c/code\u003e, raises in \u003ccode\u003edecode/2\u003c/code\u003e when the body starts with the bytes \u003ccode\u003e131, 80\u003c/code\u003e (the compressed term tag), and delegates all other calls to \u003ccode\u003eGRPC.Codec.Erlpack\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Remove `GRPC.Codec.Erlpack` from the server\u0027s `codecs` list if the codec is not needed.\n\nIf the codec is needed, register a wrapper codec in its place. The wrapper implements the `GRPC.Codec` behaviour, returns `\"erlpack\"` from `name/0`, raises in `decode/2` when the body starts with the bytes `131, 80` (the compressed term tag), and delegates all other calls to `GRPC.Codec.Erlpack`."
}
],
"value": "Remove GRPC.Codec.Erlpack from the server\u0027s codecs list if the codec is not needed.\n\nIf the codec is needed, register a wrapper codec in its place. The wrapper implements the GRPC.Codec behaviour, returns \"erlpack\" from name/0, raises in decode/2 when the body starts with the bytes 131, 80 (the compressed term tag), and delegates all other calls to GRPC.Codec.Erlpack."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eStart a gRPC server that registers \u003ccode\u003eGRPC.Codec.Erlpack\u003c/code\u003e in its \u003ccode\u003ecodecs\u003c/code\u003e list.\u003c/li\u003e\n\u003cli\u003eBuild the payload with \u003ccode\u003e:erlang.term_to_binary(:binary.copy(\u0026lt;\u0026lt;0\u0026gt;\u0026gt;, 268_435_456), [:compressed])\u003c/code\u003e. The result is 260,932 bytes.\u003c/li\u003e\n\u003cli\u003eSend the payload as one uncompressed gRPC message (compressed flag 0) to any method of the server, with \u003ccode\u003eContent-Type: application/grpc+erlpack\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eObserve that the server allocates the 268,435,456-byte binary and passes it to the application callback.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a gRPC server that registers `GRPC.Codec.Erlpack` in its `codecs` list.\n2. Build the payload with `:erlang.term_to_binary(:binary.copy(\u003c\u003c0\u003e\u003e, 268_435_456), [:compressed])`. The result is 260,932 bytes.\n3. Send the payload as one uncompressed gRPC message (compressed flag 0) to any method of the server, with `Content-Type: application/grpc+erlpack`.\n4. Observe that the server allocates the 268,435,456-byte binary and passes it to the application callback."
}
],
"value": "* Start a gRPC server that registers GRPC.Codec.Erlpack in its codecs list.\n* Build the payload with :erlang.term_to_binary(:binary.copy(\u003c\u003c0\u003e\u003e, 268_435_456), [:compressed]). The result is 260,932 bytes.\n* Send the payload as one uncompressed gRPC message (compressed flag 0) to any method of the server, with Content-Type: application/grpc+erlpack.\n* Observe that the server allocates the 268,435,456-byte binary and passes it to the application callback."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Codec selection\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe server selects the codec from the request \u003ccode\u003eContent-Type\u003c/code\u003e. \u003ccode\u003eapplication/grpc+erlpack\u003c/code\u003e selects \u003ccode\u003eGRPC.Codec.Erlpack\u003c/code\u003e when the server registers it. No authentication step comes before this.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Size limit on compressed bytes only\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe server limits the request body with \u003ccode\u003emax_body_size\u003c/code\u003e, which counts the bytes received. With the gRPC compressed flag set to 0, the transport decompression limit does not apply, and the message reaches the codec unchanged.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Expansion inside \u003ccode\u003ebinary_to_term/2\u003c/code\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eGRPC.Codec.Erlpack.decode/2\u003c/code\u003e calls \u003ccode\u003e:erlang.binary_to_term(binary, [:safe])\u003c/code\u003e. The Erlang external term format has a compressed form (version byte 131, tag 80, a 32-bit uncompressed size, then a zlib stream). \u003ccode\u003ebinary_to_term/2\u003c/code\u003e inflates it in full, and the \u003ccode\u003e:safe\u003c/code\u003e option does not limit the size. \u003ccode\u003eensure_safe_term!/1\u003c/code\u003e runs after the call returns and accepts a large binary.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4. Result\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eIn a test against grpc_server 1.0.6, a 260,932-byte request body decoded to a 268,435,456-byte binary, which the server passed to the application callback.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Codec selection**\n\nThe server selects the codec from the request `Content-Type`. `application/grpc+erlpack` selects `GRPC.Codec.Erlpack` when the server registers it. No authentication step comes before this.\n\n**2. Size limit on compressed bytes only**\n\nThe server limits the request body with `max_body_size`, which counts the bytes received. With the gRPC compressed flag set to 0, the transport decompression limit does not apply, and the message reaches the codec unchanged.\n\n**3. Expansion inside `binary_to_term/2`**\n\n`GRPC.Codec.Erlpack.decode/2` calls `:erlang.binary_to_term(binary, [:safe])`. The Erlang external term format has a compressed form (version byte 131, tag 80, a 32-bit uncompressed size, then a zlib stream). `binary_to_term/2` inflates it in full, and the `:safe` option does not limit the size. `ensure_safe_term!/1` runs after the call returns and accepts a large binary.\n\n**4. Result**\n\nIn a test against grpc_server 1.0.6, a 260,932-byte request body decoded to a 268,435,456-byte binary, which the server passed to the application callback."
}
],
"value": "1. Codec selection\n\nThe server selects the codec from the request Content-Type. application/grpc+erlpack selects GRPC.Codec.Erlpack when the server registers it. No authentication step comes before this.\n\n2. Size limit on compressed bytes only\n\nThe server limits the request body with max_body_size, which counts the bytes received. With the gRPC compressed flag set to 0, the transport decompression limit does not apply, and the message reaches the codec unchanged.\n\n3. Expansion inside binary_to_term/2\n\nGRPC.Codec.Erlpack.decode/2 calls :erlang.binary_to_term(binary, [:safe]). The Erlang external term format has a compressed form (version byte 131, tag 80, a 32-bit uncompressed size, then a zlib stream). binary_to_term/2 inflates it in full, and the :safe option does not limit the size. ensure_safe_term!/1 runs after the call returns and accepts a large binary.\n\n4. Result\n\nIn a test against grpc_server 1.0.6, a 260,932-byte request body decoded to a 268,435,456-byte binary, which the server passed to the application callback."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-121808",
"datePublished": "2026-11-13T15:48:49.871Z",
"dateReserved": "2026-11-09T22:35:50.462Z",
"dateUpdated": "2026-11-13T15:48:49.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123635 (GCVE-0-2026-123635)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:40 – Updated: 2026-11-13 15:40
VLAI
EPSS
VEX
Title
Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server
Summary
Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.
The stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.
This issue affects grpc_server: from 1.0.0 before 1.1.0.
Severity
CWE
- CWE-772 - Missing Release of Resource after Effective Lifetime
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-123635.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-123635 | related |
| https://github.com/elixir-grpc/grpc/commit/0332fa… | related |
| https://github.com/elixir-grpc/grpc/commit/61a719… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc_server |
Affected:
1.0.0 , < 1.1.0
(semver)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc_server |
Affected:
0332faae5f5e132314794dbfdae5edecbccea292 , < 61a71948e6e7b95efb27d48e7084c764503cc802
(git)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"grpc_stream_h"
],
"packageName": "grpc_server",
"packageURL": "pkg:hex/grpc_server",
"product": "grpc_server",
"programFiles": [
"src/grpc_stream_h.erl"
],
"programRoutines": [
{
"name": "grpc_stream_h:init/3"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"grpc_stream_h"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_server",
"programFiles": [
"grpc_server/src/grpc_stream_h.erl"
],
"programRoutines": [
{
"name": "grpc_stream_h:init/3"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "61a71948e6e7b95efb27d48e7084c764503cc802",
"status": "affected",
"version": "0332faae5f5e132314794dbfdae5edecbccea292",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCalls from more than one caller must share one HTTP/2 connection to the server, for example through a proxy or a shared client channel.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Calls from more than one caller must share one HTTP/2 connection to the server, for example through a proxy or a shared client channel."
}
],
"value": "Calls from more than one caller must share one HTTP/2 connection to the server, for example through a proxy or a shared client channel."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Aaron Lovi"
},
{
"lang": "en",
"type": "finder",
"value": "Aaron Lovi"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-11-12T20:33:14.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.\u003c/p\u003e\n\u003cp\u003eThe stream handler \u003ccode\u003egrpc_stream_h\u003c/code\u003e (\u003ccode\u003egrpc_server/src/grpc_stream_h.erl\u003c/code\u003e) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds \u003ccode\u003emax_body_size\u003c/code\u003e or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc_server: from 1.0.0 before 1.1.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.\n\nThe stream handler `grpc_stream_h` (`grpc_server/src/grpc_stream_h.erl`) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds `max_body_size` or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."
}
],
"value": "Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.\n\nThe stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-131",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally."
}
],
"value": "A client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-772",
"description": "CWE-772 Missing Release of Resource after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:40:16.288Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-7x9q-vvph-rjcr"
},
{
"name": "EEF CNA record for CVE-2026-123635",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-123635.html"
},
{
"name": "OSV record EEF-CVE-2026-123635",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-123635"
},
{
"name": "Introducing commit 0332faa in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
},
{
"name": "Fix commit 61a7194 in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/61a71948e6e7b95efb27d48e7084c764503cc802"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePut a Cowboy stream handler in front of \u003ccode\u003egrpc_stream_h\u003c/code\u003e with the adapter option \u003ccode\u003estream_handlers: [MyHandler, :grpc_stream_h]\u003c/code\u003e. In \u003ccode\u003einit/3\u003c/code\u003e, the handler calls \u003ccode\u003e:cowboy_stream.init/3\u003c/code\u003e and adds a \u003ccode\u003e{:flow, size}\u003c/code\u003e command when the request has a body, where \u003ccode\u003esize\u003c/code\u003e is Cowboy\u0027s \u003ccode\u003emax_frame_size_received\u003c/code\u003e (16384 by default). It passes all other callbacks to \u003ccode\u003e:cowboy_stream\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Put a Cowboy stream handler in front of `grpc_stream_h` with the adapter option `stream_handlers: [MyHandler, :grpc_stream_h]`. In `init/3`, the handler calls `:cowboy_stream.init/3` and adds a `{:flow, size}` command when the request has a body, where `size` is Cowboy\u0027s `max_frame_size_received` (16384 by default). It passes all other callbacks to `:cowboy_stream`."
}
],
"value": "Put a Cowboy stream handler in front of grpc_stream_h with the adapter option stream_handlers: [MyHandler, :grpc_stream_h]. In init/3, the handler calls :cowboy_stream.init/3 and adds a {:flow, size} command when the request has a body, where size is Cowboy\u0027s max_frame_size_received (16384 by default). It passes all other callbacks to :cowboy_stream."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eStart a gRPC server with a small \u003ccode\u003emax_body_size\u003c/code\u003e, for example 1000 bytes.\u003c/li\u003e\n\u003cli\u003eOpen one HTTP/2 connection with a client that tracks the connection window.\u003c/li\u003e\n\u003cli\u003eSend a unary call with a body above the limit and wait for the \u003ccode\u003eRESOURCE_EXHAUSTED\u003c/code\u003e reply.\u003c/li\u003e\n\u003cli\u003eSend more DATA frames on the refused stream, up to what the stream and connection windows allow.\u003c/li\u003e\n\u003cli\u003eRepeat steps 3 and 4 on new streams until the connection window is 0.\u003c/li\u003e\n\u003cli\u003eSend a small valid unary call on the same connection. Observe that its body cannot be sent and that the call ends at its deadline.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a gRPC server with a small `max_body_size`, for example 1000 bytes.\n2. Open one HTTP/2 connection with a client that tracks the connection window.\n3. Send a unary call with a body above the limit and wait for the `RESOURCE_EXHAUSTED` reply.\n4. Send more DATA frames on the refused stream, up to what the stream and connection windows allow.\n5. Repeat steps 3 and 4 on new streams until the connection window is 0.\n6. Send a small valid unary call on the same connection. Observe that its body cannot be sent and that the call ends at its deadline."
}
],
"value": "* Start a gRPC server with a small max_body_size, for example 1000 bytes.\n* Open one HTTP/2 connection with a client that tracks the connection window.\n* Send a unary call with a body above the limit and wait for the RESOURCE_EXHAUSTED reply.\n* Send more DATA frames on the refused stream, up to what the stream and connection windows allow.\n* Repeat steps 3 and 4 on new streams until the connection window is 0.\n* Send a small valid unary call on the same connection. Observe that its body cannot be sent and that the call ends at its deadline."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Flow is requested only for data that arrived\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eCowboy increases the HTTP/2 connection window only when a stream handler returns a \u003ccode\u003e{flow, N}\u003c/code\u003e command. \u003ccode\u003egrpc_stream_h\u003c/code\u003e returns that command only for request data it has received.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. A refused call leaves data uncredited\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eWhen the server refuses a call, the stream stops. The client can still have DATA frames in flight for it. Cowboy drops those frames without running the handler, so no flow is requested for their bytes and no connection-level \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e is sent.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. The window empties\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eEach refused call with DATA in flight reduces the connection window for good. With the default 65,535-byte window, the window was empty after two refused calls in a test against v1.0.6. An empty window stops all request data, so no handler requests flow again and the window stays empty.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4. Result\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eEvery later call on the connection that has a request body waits until its deadline. A new connection works normally.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Flow is requested only for data that arrived**\n\nCowboy increases the HTTP/2 connection window only when a stream handler returns a `{flow, N}` command. `grpc_stream_h` returns that command only for request data it has received.\n\n**2. A refused call leaves data uncredited**\n\nWhen the server refuses a call, the stream stops. The client can still have DATA frames in flight for it. Cowboy drops those frames without running the handler, so no flow is requested for their bytes and no connection-level `WINDOW_UPDATE` is sent.\n\n**3. The window empties**\n\nEach refused call with DATA in flight reduces the connection window for good. With the default 65,535-byte window, the window was empty after two refused calls in a test against v1.0.6. An empty window stops all request data, so no handler requests flow again and the window stays empty.\n\n**4. Result**\n\nEvery later call on the connection that has a request body waits until its deadline. A new connection works normally."
}
],
"value": "1. Flow is requested only for data that arrived\n\nCowboy increases the HTTP/2 connection window only when a stream handler returns a {flow, N} command. grpc_stream_h returns that command only for request data it has received.\n\n2. A refused call leaves data uncredited\n\nWhen the server refuses a call, the stream stops. The client can still have DATA frames in flight for it. Cowboy drops those frames without running the handler, so no flow is requested for their bytes and no connection-level WINDOW_UPDATE is sent.\n\n3. The window empties\n\nEach refused call with DATA in flight reduces the connection window for good. With the default 65,535-byte window, the window was empty after two refused calls in a test against v1.0.6. An empty window stops all request data, so no handler requests flow again and the window stays empty.\n\n4. Result\n\nEvery later call on the connection that has a request body waits until its deadline. A new connection works normally."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-123635",
"datePublished": "2026-11-13T15:40:16.288Z",
"dateReserved": "2026-11-09T22:27:54.995Z",
"dateUpdated": "2026-11-13T15:40:16.288Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71397 (GCVE-0-2026-71397)
Vulnerability from cvelistv5 – Published: 2026-11-06 21:02 – Updated: 2026-11-10 14:17
VLAI
EPSS
VEX
Title
Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server
Summary
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body.
The streaming read clause of 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) never checks the configured max_body_size. Only the unary read path enforces that cap. 'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex) appends every received chunk to its buffer until a complete length-prefixed message arrives. A client can declare a very large message and send it across many small HTTP/2 DATA frames, and the server buffers all of it.
This issue affects grpc_server: from 1.0.0 before 1.0.6.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:16 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-71397.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-71397 | related |
| https://github.com/elixir-grpc/grpc/commit/49e18c… | related |
| https://github.com/elixir-grpc/grpc/commit/0b663c… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc_server |
Affected:
1.0.0 , < 1.0.6
(semver)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc_server |
Affected:
49e18c3ec6bb9afe2f712caad3dbab5c56a68a00 , < 0b663ca53dbf0f36f7f67ff1d0026f4482a18915
(git)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71397",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:16:42.568773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:17:05.630Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-vx6q-cr5q-945g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "grpc_server",
"packageURL": "pkg:hex/grpc_server",
"product": "grpc_server",
"programFiles": [
"lib/grpc/server/adapters/cowboy/handler.ex",
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.6",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027",
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_server",
"programFiles": [
"grpc_server/lib/grpc/server/adapters/cowboy/handler.ex",
"grpc_server/lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "0b663ca53dbf0f36f7f67ff1d0026f4482a18915",
"status": "affected",
"version": "49e18c3ec6bb9afe2f712caad3dbab5c56a68a00",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe server must expose at least one client-streaming or bidirectional-streaming RPC method.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."
}
],
"value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.6",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arpit Jain"
},
{
"lang": "en",
"type": "reporter",
"value": "Arpit Jain"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Arpit Jain"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body.\u003c/p\u003e\n\u003cp\u003eThe streaming read clause of \u003ccode\u003e\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3\u003c/code\u003e (\u003ccode\u003egrpc_server/lib/grpc/server/adapters/cowboy/handler.ex\u003c/code\u003e) never checks the configured \u003ccode\u003emax_body_size\u003c/code\u003e. Only the unary read path enforces that cap. \u003ccode\u003e\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1\u003c/code\u003e (\u003ccode\u003egrpc_server/lib/grpc/server/adapters/cowboy.ex\u003c/code\u003e) appends every received chunk to its buffer until a complete length-prefixed message arrives. A client can declare a very large message and send it across many small HTTP/2 DATA frames, and the server buffers all of it.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc_server: from 1.0.0 before 1.0.6.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body.\n\nThe streaming read clause of `\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3` (`grpc_server/lib/grpc/server/adapters/cowboy/handler.ex`) never checks the configured `max_body_size`. Only the unary read path enforces that cap. `\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1` (`grpc_server/lib/grpc/server/adapters/cowboy.ex`) appends every received chunk to its buffer until a complete length-prefixed message arrives. A client can declare a very large message and send it across many small HTTP/2 DATA frames, and the server buffers all of it.\n\nThis issue affects grpc_server: from 1.0.0 before 1.0.6."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body.\n\nThe streaming read clause of \u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) never checks the configured max_body_size. Only the unary read path enforces that cap. \u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex) appends every received chunk to its buffer until a complete length-prefixed message arrives. A client can declare a very large message and send it across many small HTTP/2 DATA frames, and the server buffers all of it.\n\nThis issue affects grpc_server: from 1.0.0 before 1.0.6."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated client can crash a \u003ccode\u003egrpc_server\u003c/code\u003e node through one streaming RPC connection. This takes down every service on that node.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated client can crash a `grpc_server` node through one streaming RPC connection. This takes down every service on that node."
}
],
"value": "An unauthenticated client can crash a grpc_server node through one streaming RPC connection. This takes down every service on that node."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T21:02:03.676Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-vx6q-cr5q-945g"
},
{
"name": "EEF CNA record for CVE-2026-71397",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-71397.html"
},
{
"name": "OSV record EEF-CVE-2026-71397",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-71397"
},
{
"name": "Introducing commit 49e18c3 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/49e18c3ec6bb9afe2f712caad3dbab5c56a68a00"
},
{
"name": "Fix commit 0b663ca in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/0b663ca53dbf0f36f7f67ff1d0026f4482a18915"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server",
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eStart a \u003ccode\u003egrpc_server\u003c/code\u003e endpoint that exposes a client-streaming or bidirectional-streaming RPC method.\u003c/li\u003e\n\u003cli\u003eOpen an HTTP/2 connection and send a request to that method.\u003c/li\u003e\n\u003cli\u003eSend the request body across many small HTTP/2 DATA frames without \u003ccode\u003eEND_STREAM\u003c/code\u003e, well past the configured \u003ccode\u003emax_body_size\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eObserve that the server buffers all of it and server memory grows. The equivalent unary call is rejected with \u003ccode\u003eRESOURCE_EXHAUSTED\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a `grpc_server` endpoint that exposes a client-streaming or bidirectional-streaming RPC method.\n2. Open an HTTP/2 connection and send a request to that method.\n3. Send the request body across many small HTTP/2 DATA frames without `END_STREAM`, well past the configured `max_body_size`.\n4. Observe that the server buffers all of it and server memory grows. The equivalent unary call is rejected with `RESOURCE_EXHAUSTED`."
}
],
"value": "* Start a grpc_server endpoint that exposes a client-streaming or bidirectional-streaming RPC method.\n* Open an HTTP/2 connection and send a request to that method.\n* Send the request body across many small HTTP/2 DATA frames without END_STREAM, well past the configured max_body_size.\n* Observe that the server buffers all of it and server memory grows. The equivalent unary call is rejected with RESOURCE_EXHAUSTED."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. The cap applies to unary reads only\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe commit that added \u003ccode\u003emax_body_size\u003c/code\u003e checks it in \u003ccode\u003eread_full_body/4\u003c/code\u003e, which serves unary requests through the \u003ccode\u003e{:read_full_body, ref, pid}\u003c/code\u003e clause of \u003ccode\u003e\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3\u003c/code\u003e. The \u003ccode\u003e{:read_body, ref, pid}\u003c/code\u003e clause, which serves streaming requests, returns each chunk to the caller with no size check.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Unbounded buffering\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003e\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1\u003c/code\u003e reads chunks through that clause and appends each one to a binary buffer. It emits a message only when \u003ccode\u003eGRPC.Message.get_message/1\u003c/code\u003e finds a complete length-prefixed gRPC message in the buffer. Until then, the buffer grows with every chunk.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Memory exhaustion\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eA client that declares a large message length and keeps sending DATA frames without \u003ccode\u003eEND_STREAM\u003c/code\u003e makes the buffer grow without limit. The BEAM eventually runs out of memory and the node crashes.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. The cap applies to unary reads only**\n\nThe commit that added `max_body_size` checks it in `read_full_body/4`, which serves unary requests through the `{:read_full_body, ref, pid}` clause of `\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3`. The `{:read_body, ref, pid}` clause, which serves streaming requests, returns each chunk to the caller with no size check.\n\n**2. Unbounded buffering**\n\n`\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1` reads chunks through that clause and appends each one to a binary buffer. It emits a message only when `GRPC.Message.get_message/1` finds a complete length-prefixed gRPC message in the buffer. Until then, the buffer grows with every chunk.\n\n**3. Memory exhaustion**\n\nA client that declares a large message length and keeps sending DATA frames without `END_STREAM` makes the buffer grow without limit. The BEAM eventually runs out of memory and the node crashes."
}
],
"value": "1. The cap applies to unary reads only\n\nThe commit that added max_body_size checks it in read_full_body/4, which serves unary requests through the {:read_full_body, ref, pid} clause of \u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:info/3. The {:read_body, ref, pid} clause, which serves streaming requests, returns each chunk to the caller with no size check.\n\n2. Unbounded buffering\n\n\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1 reads chunks through that clause and appends each one to a binary buffer. It emits a message only when GRPC.Message.get_message/1 finds a complete length-prefixed gRPC message in the buffer. Until then, the buffer grows with every chunk.\n\n3. Memory exhaustion\n\nA client that declares a large message length and keeps sending DATA frames without END_STREAM makes the buffer grow without limit. The BEAM eventually runs out of memory and the node crashes."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-71397",
"datePublished": "2026-11-06T21:02:03.676Z",
"dateReserved": "2026-08-19T10:30:01.929Z",
"dateUpdated": "2026-11-10T14:17:05.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48853 (GCVE-0-2026-48853)
Vulnerability from cvelistv5 – Published: 2026-06-15 21:56 – Updated: 2026-09-24 21:08
VLAI
EPSS
VEX
Title
Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc
Summary
Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.
'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.
This issue affects grpc: from 0.4.0 before 1.0.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 14:44 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-48853.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-48853 | related |
| https://github.com/elixir-grpc/grpc/commit/25bcc5… | related |
| https://github.com/elixir-grpc/grpc/commit/272a97… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc |
Affected:
0.4.0 , < 1.0.0
(semver)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
25bcc569fe2cc4478531a6c546c923205fc751c9 , < 272a97a5ea1b46af1819f14a831fcf35fc91f992
(git)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
Date Public
2026-06-15 21:56
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48853",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T14:44:19.175606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T14:45:02.196Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Codec.Erlpack\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.4.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Codec.Erlpack\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/codec/erlpack.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "272a97a5ea1b46af1819f14a831fcf35fc91f992",
"status": "affected",
"version": "25bcc569fe2cc4478531a6c546c923205fc751c9",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003ccode\u003eGRPC.Codec.Erlpack\u003c/code\u003e must be explicitly registered as a codec on the gRPC server.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "`GRPC.Codec.Erlpack` must be explicitly registered as a codec on the gRPC server."
}
],
"value": "GRPC.Codec.Erlpack must be explicitly registered as a codec on the gRPC server."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"datePublic": "2026-06-15T21:56:15.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDeserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003e\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2\u003c/code\u003e (\u003ccode\u003elib/grpc/codec/erlpack.ex\u003c/code\u003e) calls \u003ccode\u003e:erlang.binary_to_term/1\u003c/code\u003e on the raw gRPC message body without the \u003ccode\u003e:safe\u003c/code\u003e option, no size bound, and no type guard. Any unauthenticated peer that sends a request with \u003ccode\u003eContent-Type: application/grpc+erlpack\u003c/code\u003e can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc: from 0.4.0 before 1.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.\n\n`\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2` (`lib/grpc/codec/erlpack.ex`) calls `:erlang.binary_to_term/1` on the raw gRPC message body without the `:safe` option, no size bound, and no type guard. Any unauthenticated peer that sends a request with `Content-Type: application/grpc+erlpack` can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0."
}
],
"value": "Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.\n\n\u0027Elixir.GRPC.Codec.Erlpack\u0027:decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
},
{
"capecId": "CAPEC-231",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-231 Oversized Serialized Data Payloads"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T21:08:47.457Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h"
},
{
"name": "EEF CNA record for CVE-2026-48853",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48853.html"
},
{
"name": "OSV record EEF-CVE-2026-48853",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48853"
},
{
"name": "Introducing commit 25bcc56 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/25bcc569fe2cc4478531a6c546c923205fc751c9"
},
{
"name": "Fix commit 272a97a in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-48853",
"datePublished": "2026-06-15T21:56:15.262Z",
"dateReserved": "2026-05-25T20:44:10.696Z",
"dateUpdated": "2026-09-24T21:08:47.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53430 (GCVE-0-2026-53430)
Vulnerability from cvelistv5 – Published: 2026-06-15 21:55 – Updated: 2026-06-17 04:46
VLAI
EPSS
VEX
Title
grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1
Summary
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Message modules) allows a denial of service via a gzip decompression bomb.
This vulnerability is associated with program files lib/grpc/compressor/gzip.ex, lib/grpc/message.ex and program routines 'Elixir.GRPC.Compressor.Gzip':decompress/1, 'Elixir.GRPC.Message':from_data/2.
'Elixir.GRPC.Compressor.Gzip':decompress/1 calls :zlib.gunzip/1 directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip GRPC.Compressor implementation, it is invoked automatically whenever an incoming gRPC frame carries the grpc-encoding: gzip header. :zlib.gunzip/1 allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The max_receive_message_length limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node's heap and trigger an out-of-memory kill.
This issue affects grpc: from 0.4.0 before 1.0.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 14:42 UTC
CWE
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-53430.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-53430 | related |
| https://github.com/elixir-grpc/grpc/commit/1afbab… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc |
Affected:
0.4.0 , < 1.0.0
(semver)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
beae6800fc8baf126f3fe7107d86a50e105275ba , < 1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc
(git)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53430",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T14:42:39.467618Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T14:43:11.143Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Compressor.Gzip\u0027",
"\u0027Elixir.GRPC.Message\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/compressor/gzip.ex",
"lib/grpc/message.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Compressor.Gzip\u0027:decompress/1"
},
{
"name": "\u0027Elixir.GRPC.Message\u0027:from_data/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.4.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Compressor.Gzip\u0027",
"\u0027Elixir.GRPC.Message\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/compressor/gzip.ex",
"lib/grpc/message.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Compressor.Gzip\u0027:decompress/1"
},
{
"name": "\u0027Elixir.GRPC.Message\u0027:from_data/2"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc",
"status": "affected",
"version": "beae6800fc8baf126f3fe7107d86a50e105275ba",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (\u003ctt\u003eGRPC.Compressor.Gzip\u003c/tt\u003e, \u003ctt\u003eGRPC.Message\u003c/tt\u003e modules) allows a denial of service via a gzip decompression bomb.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/grpc/compressor/gzip.ex\u003c/tt\u003e, \u003ctt\u003elib/grpc/message.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.GRPC.Compressor.Gzip\u0027:decompress/1\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.GRPC.Message\u0027:from_data/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003e\u003ctt\u003e\u0027Elixir.GRPC.Compressor.Gzip\u0027:decompress/1\u003c/tt\u003e calls \u003ctt\u003e:zlib.gunzip/1\u003c/tt\u003e directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip \u003ctt\u003eGRPC.Compressor\u003c/tt\u003e implementation, it is invoked automatically whenever an incoming gRPC frame carries the \u003ctt\u003egrpc-encoding: gzip\u003c/tt\u003e header. \u003ctt\u003e:zlib.gunzip/1\u003c/tt\u003e allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The \u003ctt\u003emax_receive_message_length\u003c/tt\u003e limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node\u0027s heap and trigger an out-of-memory kill.\u003c/p\u003e\u003cp\u003eThis issue affects grpc: from 0.4.0 before 1.0.0.\u003c/p\u003e"
}
],
"value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Message modules) allows a denial of service via a gzip decompression bomb.\n\nThis vulnerability is associated with program files lib/grpc/compressor/gzip.ex, lib/grpc/message.ex and program routines \u0027Elixir.GRPC.Compressor.Gzip\u0027:decompress/1, \u0027Elixir.GRPC.Message\u0027:from_data/2.\n\n\u0027Elixir.GRPC.Compressor.Gzip\u0027:decompress/1 calls :zlib.gunzip/1 directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip GRPC.Compressor implementation, it is invoked automatically whenever an incoming gRPC frame carries the grpc-encoding: gzip header. :zlib.gunzip/1 allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The max_receive_message_length limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node\u0027s heap and trigger an out-of-memory kill.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T04:46:39.180Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-53430.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-53430"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-53430",
"datePublished": "2026-06-15T21:55:33.707Z",
"dateReserved": "2026-06-09T11:01:47.529Z",
"dateUpdated": "2026-06-17T04:46:39.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48599 (GCVE-0-2026-48599)
Vulnerability from cvelistv5 – Published: 2026-06-15 21:55 – Updated: 2026-09-24 21:04
VLAI
EPSS
VEX
Title
Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding
Summary
Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.
In 'Elixir.GRPC.Server.Transcode':map_request/5 (lib/grpc/server/transcode.ex), all three clauses use Map.merge/2 with path bindings as the first argument, giving them the lowest merge precedence. A request such as GET /users/me/profile?user_id=victim (or a POST with {"user_id": "victim"} when body: "*") yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.
This issue affects grpc: from 0.8.0 before 1.0.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 14:45 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-48599.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-48599 | related |
| https://github.com/elixir-grpc/grpc/commit/8aaf3d… | related |
| https://github.com/elixir-grpc/grpc/commit/33b6a0… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc |
Affected:
0.8.0 , < 1.0.0
(semver)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048 , < 33b6a095dbc91c6dee3c7b90893d7d74952e82e4
(git)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
Date Public
2026-06-15 21:55
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48599",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T14:45:46.288762Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T14:46:09.673Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Transcode\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/transcode.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.8.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Transcode\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/transcode.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "33b6a095dbc91c6dee3c7b90893d7d74952e82e4",
"status": "affected",
"version": "8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eHTTP-to-gRPC transcoding must be enabled.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "HTTP-to-gRPC transcoding must be enabled."
}
],
"value": "HTTP-to-gRPC transcoding must be enabled."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.8.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"datePublic": "2026-06-15T21:55:28.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.\u003c/p\u003e\n\u003cp\u003eIn \u003ccode\u003e\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5\u003c/code\u003e (\u003ccode\u003elib/grpc/server/transcode.ex\u003c/code\u003e), all three clauses use \u003ccode\u003eMap.merge/2\u003c/code\u003e with path bindings as the first argument, giving them the lowest merge precedence. A request such as \u003ccode\u003eGET /users/me/profile?user_id=victim\u003c/code\u003e (or a POST with \u003ccode\u003e{\"user_id\": \"victim\"}\u003c/code\u003e when \u003ccode\u003ebody: \"*\"\u003c/code\u003e) yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc: from 0.8.0 before 1.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.\n\nIn `\u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5` (`lib/grpc/server/transcode.ex`), all three clauses use `Map.merge/2` with path bindings as the first argument, giving them the lowest merge precedence. A request such as `GET /users/me/profile?user_id=victim` (or a POST with `{\"user_id\": \"victim\"}` when `body: \"*\"`) yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.\n\nThis issue affects grpc: from 0.8.0 before 1.0.0."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body.\n\nIn \u0027Elixir.GRPC.Server.Transcode\u0027:map_request/5 (lib/grpc/server/transcode.ex), all three clauses use Map.merge/2 with path bindings as the first argument, giving them the lowest merge precedence. A request such as GET /users/me/profile?user_id=victim (or a POST with {\"user_id\": \"victim\"} when body: \"*\") yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed.\n\nThis issue affects grpc: from 0.8.0 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-460",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-460 HTTP Parameter Pollution (HPP)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T21:04:08.766Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq"
},
{
"name": "EEF CNA record for CVE-2026-48599",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48599.html"
},
{
"name": "OSV record EEF-CVE-2026-48599",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48599"
},
{
"name": "Introducing commit 8aaf3d3 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048"
},
{
"name": "Fix commit 33b6a09 in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-48599",
"datePublished": "2026-06-15T21:55:28.702Z",
"dateReserved": "2026-05-22T09:36:56.834Z",
"dateUpdated": "2026-09-24T21:04:08.766Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48854 (GCVE-0-2026-48854)
Vulnerability from cvelistv5 – Published: 2026-06-15 21:55 – Updated: 2026-09-24 21:09
VLAI
EPSS
VEX
Title
Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc
Summary
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body.
'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3 (lib/grpc/server/adapters/cowboy/handler.ex) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the grpc-timeout header, the per-chunk read timeout resolves to :infinity, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node.
This issue affects grpc: from 0.3.0-alpha.2 before 1.0.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 14:47 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-48854.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-48854 | related |
| https://github.com/elixir-grpc/grpc/commit/d1abe7… | related |
| https://github.com/elixir-grpc/grpc/commit/49e18c… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-grpc | grpc |
Affected:
0.3.0-alpha.2 , < 1.0.0
(semver)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
|
| elixir-grpc | grpc |
Affected:
d1abe70a6cad6dac4a3f8235d883d7c896989560 , < 49e18c3ec6bb9afe2f712caad3dbab5c56a68a00
(git)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
Date Public
2026-06-15 21:55
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48854",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T14:47:02.881535Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T14:47:28.479Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-q8gf-9rvj-gmgj"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:read_full_body/3"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.3.0-alpha.2",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/adapters/cowboy/handler.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:read_full_body/3"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "49e18c3ec6bb9afe2f712caad3dbab5c56a68a00",
"status": "affected",
"version": "d1abe70a6cad6dac4a3f8235d883d7c896989560",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.3.0-alpha.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"datePublic": "2026-06-15T21:55:23.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM\u0027s memory and crash the server by streaming a large or slow-trickle unary request body.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003e\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:read_full_body/3\u003c/code\u003e (\u003ccode\u003elib/grpc/server/adapters/cowboy/handler.ex\u003c/code\u003e) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the \u003ccode\u003egrpc-timeout\u003c/code\u003e header, the per-chunk read timeout resolves to \u003ccode\u003e:infinity\u003c/code\u003e, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc: from 0.3.0-alpha.2 before 1.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM\u0027s memory and crash the server by streaming a large or slow-trickle unary request body.\n\n`\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:read_full_body/3` (`lib/grpc/server/adapters/cowboy/handler.ex`) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the `grpc-timeout` header, the per-chunk read timeout resolves to `:infinity`, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node.\n\nThis issue affects grpc: from 0.3.0-alpha.2 before 1.0.0."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM\u0027s memory and crash the server by streaming a large or slow-trickle unary request body.\n\n\u0027Elixir.GRPC.Server.Adapters.Cowboy.Handler\u0027:read_full_body/3 (lib/grpc/server/adapters/cowboy/handler.ex) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the grpc-timeout header, the per-chunk read timeout resolves to :infinity, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node.\n\nThis issue affects grpc: from 0.3.0-alpha.2 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
},
{
"capecId": "CAPEC-231",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-231 Oversized Serialized Data Payloads"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T21:09:30.485Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-q8gf-9rvj-gmgj"
},
{
"name": "EEF CNA record for CVE-2026-48854",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48854.html"
},
{
"name": "OSV record EEF-CVE-2026-48854",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48854"
},
{
"name": "Introducing commit d1abe70 in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/d1abe70a6cad6dac4a3f8235d883d7c896989560"
},
{
"name": "Fix commit 49e18c3 in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/49e18c3ec6bb9afe2f712caad3dbab5c56a68a00"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-48854",
"datePublished": "2026-06-15T21:55:23.629Z",
"dateReserved": "2026-05-25T20:44:10.697Z",
"dateUpdated": "2026-09-24T21:09:30.485Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}